by Scott Muniz | Feb 22, 2021 | Security, Technology
This article is contributed. See the original author and article here.
74cms — 74cms
|
In 74cms version 5.0.1, there is a remote code execution vulnerability in /Application/Admin/Controller/ConfigController.class.php and /ThinkPHP/Common/functions.php where attackers can obtain server permissions and control the server. |
2021-02-17 |
not yet calculated |
CVE-2020-35339
MISC
MISC |
activepresenter — activepresenter
|
ActivePresenter 6.1.6 is affected by a memory corruption vulnerability that may result in a denial of service (DoS) or arbitrary code execution. |
2021-02-15 |
not yet calculated |
CVE-2021-3375
MISC |
agora — video_sdk
|
Cleartext transmission of sensitive information in Agora Video SDK prior to 3.1 allows a remote attacker to obtain access to audio and video of any ongoing Agora video call through observation of cleartext network traffic. |
2021-02-17 |
not yet calculated |
CVE-2020-25605
MISC
MISC |
alfresco_enterprise — content_management
|
An issue was discovered in Alfresco Enterprise Content Management (ECM) before 6.2.1. A user with privileges to edit a FreeMarker template (e.g., a webscript) may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco. |
2021-02-19 |
not yet calculated |
CVE-2020-12873
MISC
MISC |
amaze — file_manager
|
Amaze File Manager before 3.5.1 allows attackers to obtain root privileges via shell metacharacters in a symbolic link. |
2021-02-19 |
not yet calculated |
CVE-2020-36246
MISC
MISC |
apache — airflow
|
The lineage endpoint of the deprecated Experimental API was not protected by authentication in Airflow 2.0.0. This allowed unauthenticated users to hit that endpoint. This is low-severity issue as the attacker needs to be aware of certain parameters to pass to that endpoint and even after can just get some metadata about a DAG and a Task. This issue affects Apache Airflow 2.0.0. |
2021-02-17 |
not yet calculated |
CVE-2021-26697
MLIST
MLIST
MISC
MLIST
MLIST |
apache — airflow
|
Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0. |
2021-02-17 |
not yet calculated |
CVE-2021-26559
MLIST
MISC
MLIST |
apache — myfaces
|
In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application. |
2021-02-19 |
not yet calculated |
CVE-2021-26296
FULLDISC
MISC |
askey — multiple_devices
|
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow cgi-bin/te_acceso_router.cgi curWebPage XSS. |
2021-02-19 |
not yet calculated |
CVE-2021-27403
MISC |
askey — multiple_devices
|
Askey RTF8115VW BR_SV_g11.11_RTF_TEF001_V6.54_V014 devices allow injection of a Host HTTP header. |
2021-02-19 |
not yet calculated |
CVE-2021-27404
MISC |
async-git — async-git
|
The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset(‘atouch HACKEDb’) |
2021-02-18 |
not yet calculated |
CVE-2020-28490
MISC
MISC
MISC |
atlassian — bitbucket_server_and_data_center
|
The Microsoft Windows Installer for Atlassian Bitbucket Server and Data Center before version 6.10.9, 7.x before 7.6.4, and from version 7.7.0 before 7.10.1 allows local attackers to escalate privileges because of weak permissions on the installation directory. |
2021-02-18 |
not yet calculated |
CVE-2020-36233
MISC
CERT-VN |
baby_care_system — baby_care_system
|
Baby Care System v1.0 is vulnerable to SQL injection via the ‘id’ parameter on the contentsectionpage.php page. |
2021-02-17 |
not yet calculated |
CVE-2021-25779
MISC |
baby_care_system — baby_care_system
|
An arbitrary file upload vulnerability has been identified in posts.php in Baby Care System 1.0. The vulnerability could be exploited by an remote attacker to upload content to the server, including PHP files, which could result in command execution and obtaining a shell. |
2021-02-17 |
not yet calculated |
CVE-2021-25780
MISC |
batflat — batlfat
|
** UNSUPPORTED WHEN ASSIGNED ** Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user’s data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer. |
2021-02-15 |
not yet calculated |
CVE-2020-35734
MISC
MISC
MISC
MISC |
bind — multiple_products
|
BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND’s default settings the vulnerable code path is not exposed, but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable, GSS-TSIG is frequently used in networks where BIND is integrated with Samba, as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However, remote code execution, while unproven, is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27, 9.12.0 -> 9.16.11, and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch |
2021-02-17 |
not yet calculated |
CVE-2020-8625
MLIST
MLIST
CONFIRM
MLIST
DEBIAN |
bloodhound — bloodhound
|
components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter. |
2021-02-19 |
not yet calculated |
CVE-2021-3210
MISC
MISC
MISC |
bolt — bolt
|
Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal. |
2021-02-17 |
not yet calculated |
CVE-2021-27367
MISC
MISC |
canary_mail — canary_mail
|
core/imap/MCIMAPSession.cpp in Canary Mail before 3.22 has Missing SSL Certificate Validation for IMAP in STARTTLS mode. |
2021-02-17 |
not yet calculated |
CVE-2021-26911
MLIST
MISC
MISC
MISC
CONFIRM
MISC |
casap — automated_enrollment_system
|
The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attacker can obtain access to the admin panel by injecting a SQL query in the username field of the login page. |
2021-02-15 |
not yet calculated |
CVE-2021-26201
MISC |
centreon — 19.10-e17
|
Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution. |
2021-02-15 |
not yet calculated |
CVE-2020-22425
MISC
MISC |
chamilo — chamilo
|
Chamilo 1.11.14 allows XSS via a main/calendar/agenda_list.php?type= URI. |
2021-02-19 |
not yet calculated |
CVE-2021-26746
CONFIRM
MISC
MISC |
checkmk — checkmk
|
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%checkmkagentlocal directory. |
2021-02-19 |
not yet calculated |
CVE-2020-24908
MISC |
cisco — anyconnect_secure_mobilty_client
|
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability, the attacker needs valid credentials on the Windows system. |
2021-02-17 |
not yet calculated |
CVE-2021-1366
CISCO |
cisco — csdj
|
Calsos CSDJ (CSDJ-B 01.08.00 and earlier, CSDJ-H 01.08.00 and earlier, CSDJ-D 01.08.00 and earlier, and CSDJ-A 03.08.00 and earlier) allows remote attackers to bypass access restriction and to obtain unauthorized historical data without access privileges via unspecified vectors. |
2021-02-17 |
not yet calculated |
CVE-2021-20653
MISC
MISC |
| cisco — identity_services_engine |
Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit these vulnerabilities by browsing to one of the pages that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system. For more information about these vulnerabilities, see the Details section of this advisory. |
2021-02-17 |
not yet calculated |
CVE-2021-1416
CISCO |
cisco — identity_services_engine
|
Multiple vulnerabilities in the Admin portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to obtain sensitive information. These vulnerabilities are due to improper enforcement of administrator privilege levels for sensitive data. An attacker with read-only administrator access to the Admin portal could exploit these vulnerabilities by browsing to one of the pages that contains sensitive data. A successful exploit could allow the attacker to collect sensitive information regarding the configuration of the system. For more information about these vulnerabilities, see the Details section of this advisory. |
2021-02-17 |
not yet calculated |
CVE-2021-1412
CISCO |
| cisco — staros |
A vulnerability in the SSH service of the Cisco StarOS operating system could allow an unauthenticated, remote attacker to cause an affected device to stop processing traffic, resulting in a denial of service (DoS) condition. The vulnerability is due to a logic error that may occur under specific traffic conditions. An attacker could exploit this vulnerability by sending a series of crafted packets to an affected device. A successful exploit could allow the attacker to prevent the targeted service from receiving any traffic, which would lead to a DoS condition on the affected device. |
2021-02-17 |
not yet calculated |
CVE-2021-1378
CISCO |
cisco — webex_meetings
|
A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. |
2021-02-17 |
not yet calculated |
CVE-2021-1351
CISCO |
cisco — webex_meetings_desktop_app_and_webex_productivity_tools
|
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authenticated with Webex on the same end-user system. |
2021-02-17 |
not yet calculated |
CVE-2021-1372
CISCO |
com.typesafe.akka:akka-http-core — com.typesafe.akka:akka-http-core
|
This affects all versions of package com.typesafe.akka:akka-http-core. It allows multiple Transfer-Encoding headers. |
2021-02-17 |
not yet calculated |
CVE-2021-23339
MISC
MISC |
d-bus — d-bus
|
A use-after-free flaw was found in D-Bus 1.12.20 when a system has multiple usernames sharing the same UID. When a set of policy rules references these usernames, D-Bus may free some memory in the heap, which is still used by data structures necessary for the other usernames sharing the UID, possibly leading to a crash or other undefined behaviors |
2021-02-15 |
not yet calculated |
CVE-2020-35512
MISC |
das — u-boot
|
The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT. |
2021-02-17 |
not yet calculated |
CVE-2021-27138
MISC
MISC
MISC |
das — u-boot
|
The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT. |
2021-02-17 |
not yet calculated |
CVE-2021-27097
MISC
MISC
MISC |
debian — avahi_package
|
avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product. |
2021-02-17 |
not yet calculated |
CVE-2021-26720
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC
MISC |
dekart — private_disk
|
In Dekart Private Disk 2.15, invalid use of the Type3 user buffer for IOCTL codes using METHOD_NEITHER results in arbitrary memory dereferencing. |
2021-02-16 |
not yet calculated |
CVE-2021-27203
MISC
MISC |
dell — emc_avamar_server
|
Dell EMC Avamar Server, versions 19.3 and 19.4 contain an Improper Authorization vulnerability in the web UI. A remote low privileged attacker could potentially exploit this vulnerability, to gain unauthorized read or modification access to other users’ backup data. |
2021-02-15 |
not yet calculated |
CVE-2021-21511
CONFIRM |
dell — emc_powerprotect_cyber_recovery
|
Dell EMC PowerProtect Cyber Recovery, version 19.7.0.1, contains an Information Disclosure vulnerability. A locally authenticated high privileged Cyber Recovery user may potentially exploit this vulnerability leading to the takeover of the notification email account. |
2021-02-19 |
not yet calculated |
CVE-2021-21512
MISC |
digi — connectport_x2e
|
Digi ConnectPort X2e before 3.2.30.6 allows an attacker to escalate privileges from the python user to root via a symlink attack that uses chown, related to /etc/init.d/S50dropbear.sh and the /WEB/python/.ssh directory. |
2021-02-18 |
not yet calculated |
CVE-2020-12878
MISC
MISC
MISC |
digium — asterisk
|
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure. |
2021-02-18 |
not yet calculated |
CVE-2021-26906
MISC
FULLDISC
MISC
CONFIRM
CONFIRM |
dji — mavic_2_remote_controller
|
A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet. |
2021-02-18 |
not yet calculated |
CVE-2020-29664
MISC
MISC
MISC
MISC |
docsify — docsify
|
This affects the package docsify before 4.12.0. It is possible to bypass the remediation done by CVE-2020-7680 and execute malicious JavaScript through the following methods 1) When parsing HTML from remote URLs, the HTML code on the main page is sanitized, but this sanitization is not taking place in the sidebar. 2) The isURL external check can be bypassed by inserting more “////” characters |
2021-02-19 |
not yet calculated |
CVE-2021-23342
FULLDISC
MISC
MISC
MISC |
doctor_appointment_system — doctor_apointment_system
|
SQL injection in the expertise parameter in search_result.php in Doctor Appointment System v1.0 allows an authenticated patient user to dump the database credentials via a SQL injection attack. |
2021-02-18 |
not yet calculated |
CVE-2021-27124
MISC
MISC
MISC |
e-learning_system — e-learning_system
|
E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell. |
2021-02-15 |
not yet calculated |
CVE-2021-3239
MISC
MISC
MISC |
endalia — selection_portal
|
In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number). |
2021-02-18 |
not yet calculated |
CVE-2020-35577
MISC
MISC |
endian — firewall_community
|
Endian Firewall Community (aka EFW) 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment. |
2021-02-15 |
not yet calculated |
CVE-2021-27201
MISC
MISC
MISC |
fedora_project — fedora_33
|
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. |
2021-02-15 |
not yet calculated |
CVE-2021-23336
MLIST
MISC
MLIST
FEDORA
FEDORA
MISC
MISC |
filezen — filezen
|
FileZen (V3.0.0 to V4.2.7 and V5.0.0 to V5.0.2) allows a remote attacker with administrator rights to execute arbitrary OS commands via unspecified vectors. |
2021-02-17 |
not yet calculated |
CVE-2021-20655
MISC
MISC |
finalwire — aida64_engineer
|
Buffer overflow in FinalWire Ltd AIDA64 Engineer 6.00.5100 allows attackers to execute arbitrary code by creating a crafted input that will overwrite the SEH handler. |
2021-02-19 |
not yet calculated |
CVE-2020-19513
EXPLOIT-DB |
friendica — friendica
|
Friendica 2021.01 allows SSRF via parse_url?binurl= for DNS lookups or HTTP requests to arbitrary domain names. |
2021-02-18 |
not yet calculated |
CVE-2021-27329
MISC |
fuji — electric_v-server_lite
|
The affected Fuji Electric V-Server Lite versions prior to 3.3.24.0 are vulnerable to an out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. |
2021-02-19 |
not yet calculated |
CVE-2020-25171
MISC |
ge-digital — hmi/scada_ifix
|
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation. |
2021-02-18 |
not yet calculated |
CVE-2019-18255
MISC |
ge-digital — hmi/scada_ifix
|
HMI/SCADA iFIX (Versions 6.1 and prior) allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation. |
2021-02-18 |
not yet calculated |
CVE-2019-18243
MISC |
gerrit — gerrit_servers
|
Any git operation is passed through Jetty and a session is created. No expiry is set for the session and Jetty does not automatically dispose of the session. Over multiple git actions, this can lead to a heap memory exhaustion for Gerrit servers. We recommend upgrading Gerrit to any of the versions listed above. |
2021-02-17 |
not yet calculated |
CVE-2021-22553
CONFIRM |
gnome — glib
|
An issue was discovered in GNOME GLib before 2.66.7 and 2.67.x before 2.67.4. If g_byte_array_new_take() was called with a buffer of 4GB or more on a 64-bit platform, the length would be truncated modulo 2**32, causing unintended length truncation. |
2021-02-15 |
not yet calculated |
CVE-2021-27218
MISC
MISC |
gnome — glib
|
An issue was discovered in GNOME GLib before 2.66.6 and 2.67.x before 2.67.3. The function g_bytes_new has an integer overflow on 64-bit platforms due to an implicit cast from 64 bits to 32 bits. The overflow could potentially lead to memory corruption. |
2021-02-15 |
not yet calculated |
CVE-2021-27219
MISC |
google — android
|
The Terminate Session feature in the Telegram application through 7.2.1 for Android, and through 2.4.7 for Windows and UNIX, fails to invalidate a recently active session. |
2021-02-19 |
not yet calculated |
CVE-2021-27351
MISC |
gramaddict — gramaddict
|
GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent. The attacker must be able to reach TCP port 7912, e.g., by being on the same Wi-Fi network. |
2021-02-17 |
not yet calculated |
CVE-2020-36245
MISC |
hestia — control_panel
|
Hestia Control Panel through 1.3.3, in a shared-hosting environment, sometimes allows remote authenticated users to create a subdomain for a different customer’s domain name, leading to spoofing of services or email messages. |
2021-02-16 |
not yet calculated |
CVE-2021-27231
MISC
MISC |
hilscher — ethernet/ip_core_v2
|
A denial of service and memory corruption vulnerability was found in Hilscher EtherNet/IP Core V2 prior to V2.13.0.21that may lead to code injection through network or make devices crash without recovery. |
2021-02-16 |
not yet calculated |
CVE-2021-20987
CONFIRM
CONFIRM |
hilscher — profinet_io_device_v3
|
A Denial of Service vulnerability was found in Hilscher PROFINET IO Device V3 in versions prior to V3.14.0.7. This may lead to unexpected loss of cyclic communication or interruption of acyclic communication. |
2021-02-16 |
not yet calculated |
CVE-2021-20986
CONFIRM
CONFIRM |
ibm — jazz_reporting_service
|
IBM Jazz Reporting Service 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 191751. |
2021-02-18 |
not yet calculated |
CVE-2020-4933
XF
CONFIRM |
ibm — maximo_for_civil_infrastructure
|
IBM Maximo for Civil Infrastructure 7.6.2 could allow a user to obtain sensitive information due to insecure storeage of authentication credentials. IBM X-Force ID: 196621. |
2021-02-18 |
not yet calculated |
CVE-2021-20445
XF
CONFIRM |
ibm — maximo_for_civil_infrastructure
|
IBM Maximo for Civil Infrastructure 7.6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 196620. |
2021-02-18 |
not yet calculated |
CVE-2021-20444
XF
CONFIRM |
ibm — maximo_for_civil_infrastructure
|
IBM Maximo for Civil Infrastructure 7.6.2 includes executable functionality (such as a library) from a source that is outside of the intended control sphere. IBM X-Force ID: 196619. |
2021-02-18 |
not yet calculated |
CVE-2021-20443
XF
CONFIRM |
ibm — websphere_application_server
|
IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories. An attacker could send a specially-crafted URL request containing “dot dot” sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 194883. |
2021-02-18 |
not yet calculated |
CVE-2021-20354
XF
CONFIRM |
intel — 10th_generation_core_processors
|
Debug message containing addresses of memory transactions in some Intel(R) 10th Generation Core Processors supporting SGX may allow a privileged user to potentially enable information disclosure via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24491
MISC |
intel — 700-series_ethernet_controllers
|
Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24495
MISC |
intel — 700-series_ethernet_controllers
|
Insufficient access control in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 8.0 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24493
MISC |
intel — 700-series_ethernet_controllers
|
Insufficient input validation in the firmware for the Intel(R) 700-series of Ethernet Controllers before version 7.3 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24505
MISC |
intel — 722_ethernet_controllers
|
Insufficient input validation in the firmware for Intel(R) 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24496
MISC |
intel — 722_ethernet_controllers
|
Insufficient access control in the firmware for the Intel(R) 722 Ethernet Controllers before version 1.4.3 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24494
MISC |
intel — 722_ethernet_controllors
|
Insufficient access control in the firmware for the Intel(R) 722 Ethernet Controllers before version 1.5 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24492
MISC |
intel — 7360_cell_modem
|
Improper buffer restrictions in firmware for Intel(R) 7360 Cell Modem before UDE version 9.4.370 may allow unauthenticated user to potentially enable denial of service via network access. |
2021-02-17 |
not yet calculated |
CVE-2020-24482
MISC |
intel — collaboration_suite
|
Insufficient control flow management in the API for the Intel(R) Collaboration Suite for WebRTC before version 4.3.1 may allow an authenticated user to potentially enable escalation of privilege via network access. |
2021-02-17 |
not yet calculated |
CVE-2020-12339
MISC |
intel — e810_ethernet_adaptor_driver
|
Improper input validation in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 and before version 1.4.29.0 for Windows*, may allow an authenticated user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24502
MISC |
intel — e810_ethernet_adaptor_drivers
|
Uncontrolled resource consumption in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24504
MISC |
intel — e810_ethernet_adaptor_drivers
|
Insufficient access control in some Intel(R) Ethernet E810 Adapter drivers for Linux before version 1.0.4 may allow an authenticated user to potentially enable information disclosure via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24503
MISC |
intel — e810_ethernet_controllers
|
Insufficient Access Control in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24497
MISC |
intel — e810_ethernet_controllers
|
Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24498
MISC |
intel — e810_ethernet_controllers
|
Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24500
MISC |
intel — e810_ethernet_controllers
|
Buffer overflow in the firmware for Intel(R) E810 Ethernet Controllers before version 1.4.1.13 may allow an unauthenticated user to potentially enable denial of service via adjacent access. |
2021-02-17 |
not yet calculated |
CVE-2020-24501
MISC |
intel — epid_sdk
|
Improper input validation in the Intel(R) EPID SDK before version 8, may allow an authenticated user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24453
MISC |
intel — ethernet_i210_controller
|
Improper access control in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may potentially allow a privileged user to enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0523
MISC |
intel — ethernet_i210_controller
|
Improper access control in firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0525
MISC |
intel — ethernet_i210_controller
|
Improper default permissions in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow an authenticated user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0524
MISC |
intel — ethernet_i210_controller
|
Improper initialization in the firmware for the Intel(R) Ethernet I210 Controller series of network adapters before version 3.30 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0522
MISC |
intel — graphics_driver
|
Improper access control for Intel(R) Graphics Drivers before version 15.45.33.5164 and 27.20.100.8280 may allow an authenticated user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-8678
MISC |
| intel — graphics_drivers |
Insufficient control flow management in the kernel mode driver for some Intel(R) Graphics Drivers before version 15.36.39.5145 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0544
MISC |
| intel — graphics_drivers |
Out-of-bounds write in some Intel(R) Graphics Drivers before version 15.36.39.5143 may allow an authenticated user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12386
MISC |
| intel — graphics_drivers |
Untrusted pointer dereference in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12370
MISC |
| intel — graphics_drivers |
Integer overflow in some Intel(R) Graphics Drivers before version 26.20.100.8476 may allow a privileged user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12367
MISC |
| intel — graphics_drivers |
Untrusted pointer dereference in some Intel(R) Graphics Drivers before versions 15.33.51.5146, 15.45.32.5145, 15.36.39.5144 and 15.40.46.5143 may allow an authenticated user to potentially denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12365
MISC |
| intel — graphics_drivers |
Insufficient input validation in some Intel(R) Graphics Drivers before version 27.20.100.8587 may allow a privileged user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12366
MISC |
| intel — graphics_drivers |
Expired pointer dereference in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12373
MISC |
intel — graphics_drivers
|
Null pointer reference in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before version Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12364
MISC |
intel — graphics_drivers
|
Integer overflow in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12368
MISC |
intel — graphics_drivers
|
Out of bound write in some Intel(R) Graphics Drivers before version 26.20.100.8336 may allow a privileged user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12369
MISC |
intel — graphics_drivers
|
Improper conditions check in some Intel(R) Graphics Drivers before versions 26.20.100.8141, 15.45.32.5145 and 15.40.46.5144 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24450
MISC |
intel — graphics_drivers
|
Divide by zero in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12371
MISC |
intel — graphics_drivers
|
Unchecked return value in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12372
MISC |
intel — graphics_drivers
|
Integer overflow in the firmware for some Intel(R) Graphics Drivers for Windows * before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12362
MISC |
intel — graphics_drivers
|
Use after free in some Intel(R) Graphics Drivers before version 15.33.51.5146 may allow an authenticated user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12361
MISC |
intel — graphics_drivers
|
Improper access control in some Intel(R) Graphics Drivers before version 26.20.100.8476 may allow an authenticated user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12384
MISC |
intel — graphics_drivers
|
Improper input validation in some Intel(R) Graphics Drivers before version 26.20.100.8141 may allow a privileged user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12385
MISC |
intel — graphics_drivers
|
Uncaught exception in some Intel(R) Graphics Drivers before version 15.33.51.5146 may allow an authenticated user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24448
MISC |
intel — graphics_drivers
|
Insufficient control flow management in some Intel(R) Graphics Drivers before version 15.45.32.5145 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0521
MISC |
intel — graphics_drivers
|
Improper input validation in some Intel(R) Graphics Drivers for Windows* before version 26.20.100.7212 and before Linux kernel version 5.5 may allow a privileged user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12363
MISC |
intel — grpahics_driver
|
Out of bounds write in the Intel(R) Graphics Driver before version 15.33.53.5161, 15.36.40.5162, 15.40.47.5166, 15.45.33.5164 and 27.20.100.8336 may allow an authenticated user to potentially enable an escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24462
MISC |
intel — hd_graphics_control_panel
|
Improper access control in the Intel(R) HD Graphics Control Panel before version 15.40.46.5144 and 15.36.39.5143 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-0518
MISC |
| intel — multiple_products |
Out of bounds read in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12380
MISC |
| intel — multiple_products |
Use of hard-coded key in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow authenticated user to potentially enable information disclosure via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12376
MISC |
| intel — multiple_products |
Insufficient input validation in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12377
MISC |
intel — multiple_products
|
Buffer overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow a privileged user to potentially enable escalation of privilege via local access. |
2021-02-19 |
not yet calculated |
CVE-2020-12374
MISC |
intel — multiple_products
|
Heap overflow in the BMC firmware for some Intel(R) Server Boards, Server Systems and Compute Modules before version 2.47 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-12375
MISC |
intel — optane_dc_persistent_memory
|
Uncontrolled search path in the Intel(R) Optane(TM) DC Persistent Memory installer for Windows* before version 1.00.00.3506 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24451
MISC |
intel — proset/wireless_wifi_and_killer_drivers
|
Incomplete cleanup in some Intel(R) PROSet/Wireless WiFi and Killer (TM) drivers before version 22.0 may allow a privileged user to potentially enable information disclosure and denial of service<b> </b>via adjacent access. |
2021-02-17 |
not yet calculated |
CVE-2020-24458
MISC |
intel — quartus_prime_pro
|
Insecure inherited permissions for the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24481
MISC |
| intel — realsense_dcm |
Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-8765
MISC |
intel — sgx_platform_software
|
Improper input validation in the Intel(R) SGX Platform Software for Windows* may allow an authenticated user to potentially enable a denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24452
MISC |
intel — soc_driver
|
Insecure inherited permissions for the Intel(R) SOC driver package for STK1A32SC before version 604 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2021-0109
MISC |
intel — ssd_toolbox
|
Incorrect default permissions in installer for the Intel(R) SSD Toolbox versions before 2/9/2021 may allow a privileged user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-8701
MISC |
intel — trace_analyzer_and_collector
|
Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escalation of privilege via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24485
MISC |
intel — xtu
|
Out-of-bounds write in the Intel(R) XTU before version 6.5.3.25 may allow a privileged user to potentially enable denial of service via local access. |
2021-02-17 |
not yet calculated |
CVE-2020-24480
MISC |
| irfanview — irfanview |
The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a Read Access Violation on Control Flow starting at WPG!ReadWPG_W+0x0000000000000133, which might allow remote attackers to execute arbitrary code. |
2021-02-17 |
not yet calculated |
CVE-2021-27362
MISC
MISC |
irfanview — irfanview
|
The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012ec6, which might allow remote attackers to execute arbitrary code. |
2021-02-17 |
not yet calculated |
CVE-2021-27224
MISC
MISC
MISC |
jackson-dataformat-cbor — jackson-dataformat-cbor
|
This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception. |
2021-02-18 |
not yet calculated |
CVE-2020-28491
CONFIRM
CONFIRM
CONFIRM |
jinjava — jinjava
|
Jinjava before 2.5.4 allow access to arbitrary classes by calling Java methods on objects passed into a Jinjava context. This could allow for abuse of the application class loader, including Arbitrary File Disclosure. |
2021-02-19 |
not yet calculated |
CVE-2020-12668
MISC
MISC
MISC
MISC
MISC |
jsdom — jsdom
|
JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled. |
2021-02-16 |
not yet calculated |
CVE-2021-20066
MISC |
kollectapps — kollectapps
|
KollectApps before 4.8.16c is affected by insecure Java deserialization, leading to Remote Code Execution via a ysoserial.payloads.CommonsCollections parameter. |
2021-02-18 |
not yet calculated |
CVE-2021-27335
MISC |
less-openui5 — less-openui5
|
less-openui5 is an npm package which enables building OpenUI5 themes with Less.js. In less-openui5 before version 0.10., when processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be executed in the context of the build process. While this is a feature of the Less.js library it is an unexpected behavior in the context of OpenUI5 and SAPUI5 development. Especially in the context of UI5 Tooling which relies on less-openui5. An attacker might create a library or theme-library containing a custom control or theme, hiding malicious JavaScript code in one of the .less files. Refer to the referenced GHSA-3crj-w4f5-gwh4 for examples. Starting with Less.js version 3.0.0, the Inline JavaScript feature is disabled by default. less-openui5 however currently uses a fork of Less.js v1.6.3. Note that disabling the Inline JavaScript feature in Less.js versions 1.x, still evaluates code has additional double codes around it. We decided to remove the inline JavaScript evaluation feature completely from the code of our Less.js fork. This fix is available in less-openui5 version 0.10.0. |
2021-02-16 |
not yet calculated |
CVE-2021-21316
MISC
MISC
MISC
CONFIRM
MISC |
library_system — library_system
|
The user area for Library System 1.0 is vulnerable to SQL injection where a user can bypass the authentication and login as the admin user. |
2021-02-15 |
not yet calculated |
CVE-2021-26200
MISC |
| linux — linux_kernel |
An issue was discovered in Xen 4.9 through 4.14.x. On Arm, a guest is allowed to control whether memory accesses are bypassing the cache. This means that Xen needs to ensure that all writes (such as the ones during scrubbing) have reached the memory before handing over the page to a guest. Unfortunately, the operation to clean the cache is happening before checking if the page was scrubbed. Therefore there is no guarantee when all the writes will reach the memory. |
2021-02-17 |
not yet calculated |
CVE-2021-26933
MISC |
| linux — linux_kernel |
An issue was discovered in the Linux kernel 4.18 through 5.10.16, as used by Xen. The backend allocation (aka be-alloc) mode of the drm_xen_front drivers was not meant to be a supported configuration, but this wasn’t stated accordingly in its support status entry. |
2021-02-17 |
not yet calculated |
CVE-2021-26934
MISC |
linux — linux_kernel
|
A NULL pointer dereference flaw in Linux kernel versions prior to 5.11 may be seen if sco_sock_getsockopt function in net/bluetooth/sco.c do not have a sanity check for a socket connection, when using BT_SNDMTU/BT_RCVMTU for SCO sockets. This could allow a local attacker with a special user privilege to crash the system (DOS) or leak kernel internal information. |
2021-02-19 |
not yet calculated |
CVE-2020-35499
MISC |
linux — linux_kernel
|
An issue was discovered in the Linux kernel 3.11 through 5.10.16, as used by Xen. To service requests to the PV backend, the driver maps grant references provided by the frontend. In this process, errors may be encountered. In one case, an error encountered earlier might be discarded by later processing, resulting in the caller assuming successful mapping, and hence subsequent operations trying to access space that wasn’t mapped. In another case, internal state would be insufficiently updated, preventing safe recovery from the error. This affects drivers/block/xen-blkback/blkback.c. |
2021-02-17 |
not yet calculated |
CVE-2021-26930
MISC |
linux — linux_kernel
|
An issue was discovered in the Linux kernel 2.6.39 through 5.10.16, as used in Xen. Block, net, and SCSI backends consider certain errors a plain bug, deliberately causing a kernel crash. For errors potentially being at least under the influence of guests (such as out of memory conditions), it isn’t correct to assume a plain bug. Memory allocations potentially causing such crashes occur only when Linux is running in PV mode, though. This affects drivers/block/xen-blkback/blkback.c and drivers/xen/xen-scsiback.c. |
2021-02-17 |
not yet calculated |
CVE-2021-26931
MISC |
linux — linux_kernel
|
An issue was discovered in the Linux kernel 3.2 through 5.10.16, as used by Xen. Grant mapping operations often occur in batch hypercalls, where a number of operations are done in a single hypercall, the success or failure of each one is reported to the backend driver, and the backend driver then loops over the results, performing follow-up actions based on the success or failure of each operation. Unfortunately, when running in PV mode, the Linux backend drivers mishandle this: Some errors are ignored, effectively implying their success from the success of related batch elements. In other cases, errors resulting from one batch element lead to further batch elements not being inspected, and hence successful ones to not be possible to properly unmap upon error recovery. Only systems with Linux backends running in PV mode are vulnerable. Linux backends run in HVM / PVH modes are not vulnerable. This affects arch/*/xen/p2m.c and drivers/xen/gntdev.c. |
2021-02-17 |
not yet calculated |
CVE-2021-26932
MISC |
livy — livy
|
Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users’ sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating. |
2021-02-20 |
not yet calculated |
CVE-2021-26544
MLIST
CONFIRM
CONFIRM |
lodash — lodash
|
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Command Injection via template. |
2021-02-15 |
not yet calculated |
CVE-2021-23337
MISC
MISC
MISC
MISC
MISC
MISC
MISC |
lodash — lodash
|
All versions of package lodash; all versions of package org.fujion.webjars:lodash are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require(‘lodash’); function build_blank (n) { var ret = “1” for (var i = 0; i < n; i++) { ret += ” ” } return ret + “1”; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() – time0; console.log(“time_cost0: ” + time_cost0) var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() – time1; console.log(“time_cost1: ” + time_cost1) var time2 = Date.now(); lo.trimEnd(s) var time_cost2 = Date.now() – time2; console.log(“time_cost2: ” + time_cost2) |
2021-02-15 |
not yet calculated |
CVE-2020-28500
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRM |
mailtrain — mailtrain
|
Mailtrain through 1.24.1 allows SQL Injection in statsClickedSubscribersByColumn in lib/models/campaigns.js via /campaigns/clicked/ajax because variable column names are not properly escaped. |
2021-02-19 |
not yet calculated |
CVE-2020-24617
MISC
MISC |
mcafee — web_gateway
|
Privilege escalation vulnerability in McAfee Web Gateway (MWG) prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance via incorrect improper neutralization of user input in the troubleshooting page. |
2021-02-17 |
not yet calculated |
CVE-2021-23885
CONFIRM |
metasys — reporting_engine_web_services
|
Path Traversal vulnerability exists in Metasys Reporting Engine (MRE) Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system. |
2021-02-19 |
not yet calculated |
CVE-2020-9050
CONFIRM
CERT |
microweber — microweber
|
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file. |
2021-02-15 |
not yet calculated |
CVE-2020-28337
MISC
MISC
MISC |
mitsubishi — electric_fa_engineering_software
|
Improper handling of length parameter inconsistency vulnerability in Mitsubishi Electric FA Engineering Software(C Controller module setting and monitoring tool all versions, CPU Module Logging Configuration Tool all versions, CW Configurator all versions, Data Transfer all versions, EZSocket all versions, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GT SoftGOT1000 Version3 all versions, GT SoftGOT2000 Version1 all versions, GX Configurator-DP versions 7.14Q and prior, GX Configurator-QP all versions, GX Developer all versions, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer all versions, GX RemoteService-I all versions, GX Works2 versions 1.597X and prior, GX Works3 versions 1.070Y and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link all versions, MELFA-Works all versions, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) all versions, MELSOFT Navigator all versions, MH11 SettingTool Version2 all versions, MI Configurator all versions, MT Works2 all versions, MX Component all versions, Network Interface Board CC IE Control utility all versions, Network Interface Board CC IE Field Utility all versions, Network Interface Board CC-Link Ver.2 Utility all versions, Network Interface Board MNETH utility all versions, PX Developer all versions, RT ToolBox2 all versions, RT ToolBox3 all versions, Setting/monitoring tools for the C Controller module all versions, SLMP Data Collector all versions) allows a remote unauthenticated attacker to cause a DoS condition of the software products, and possibly to execute a malicious program on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets. |
2021-02-19 |
not yet calculated |
CVE-2021-20588
MISC
MISC |
mitsubishi — electric_fa_engineering_software
|
Heap-based buffer overflow vulnerability in Mitsubishi Electric FA Engineering Software (C Controller module setting and monitoring tool all versions, CPU Module Logging Configuration Tool all versions, CW Configurator all versions, Data Transfer all versions, EZSocket all versions, FR Configurator all versions, FR Configurator SW3 all versions, FR Configurator2 all versions, GT Designer3 Version1(GOT1000) all versions, GT Designer3 Version1(GOT2000) all versions, GT SoftGOT1000 Version3 all versions, GT SoftGOT2000 Version1 all versions, GX Configurator-DP version 7.14Q and prior, GX Configurator-QP all versions, GX Developer all versions, GX Explorer all versions, GX IEC Developer all versions, GX LogViewer all versions, GX RemoteService-I all versions, GX Works2 version 1.597X and prior, GX Works3 version 1.070Y and prior, M_CommDTM-HART all versions, M_CommDTM-IO-Link all versions, MELFA-Works all versions, MELSEC WinCPU Setting Utility all versions, MELSOFT EM Software Development Kit (EM Configurator) all versions, MELSOFT Navigator all versions, MH11 SettingTool Version2 all versions, MI Configurator all versions, MT Works2 all versions, MX Component all versions, Network Interface Board CC IE Control utility all versions, Network Interface Board CC IE Field Utility all versions, Network Interface Board CC-Link Ver.2 Utility all versions, Network Interface Board MNETH utility all versions, PX Developer all versions, RT ToolBox2 all versions, RT ToolBox3 all versions, Setting/monitoring tools for the C Controller module all versions and SLMP Data Collector all versions) allows a remote unauthenticated attacker to cause a DoS condition of the software products, and possibly to execute a malicious program on the personal computer running the software products although it has not been reproduced, by spoofing MELSEC, GOT or FREQROL and returning crafted reply packets. |
2021-02-19 |
not yet calculated |
CVE-2021-20587
MISC
MISC |
modernflow — modernflow
|
ModernFlow before 1.3.00.208 does not constrain web-page access to members of a security group, as demonstrated by the Search Screen and the Profile Screen. |
2021-02-19 |
not yet calculated |
CVE-2021-3339
MISC
MISC |
mumble — mumble
|
Mumble before 1.3.4 allows remote code execution if a victim navigates to a crafted URL on a server list and clicks on the Open Webpage text. |
2021-02-16 |
not yet calculated |
CVE-2021-27229
MISC
MISC
MISC
MLIST |
| mutare — voice |
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, password information for external systems is visible in cleartext. The Settings.asp page is affected by this issue. |
2021-02-16 |
not yet calculated |
CVE-2021-27233
MISC |
mutare — voice
|
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. On the admin portal of the web application, there is a functionality at diagzip.asp that allows anyone to export tables of a database. |
2021-02-16 |
not yet calculated |
CVE-2021-27235
MISC |
mutare — voice
|
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. The web application suffers from SQL injection on Adminlog.asp, Archivemsgs.asp, Deletelog.asp, Eventlog.asp, and Evmlog.asp. |
2021-02-16 |
not yet calculated |
CVE-2021-27234
MISC |
mutare — voice
|
An issue was discovered in Mutare Voice (EVM) 3.x before 3.3.8. getfile.asp allows Unauthenticated Local File Inclusion, which can be leveraged to achieve Remote Code Execution. |
2021-02-16 |
not yet calculated |
CVE-2021-27236
MISC |
nagios — xi_5.7.2
|
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query. |
2021-02-15 |
not yet calculated |
CVE-2020-24899
MISC |
nagiosxi — 5.6.11
|
NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into a request. |
2021-02-15 |
not yet calculated |
CVE-2020-22427
MISC |
netis — multiple_devices
|
Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution. |
2021-02-18 |
not yet calculated |
CVE-2021-26747
MISC
MISC |
| node.js — node.js |
A ReDoS (regular expression denial of service) flaw was found in the @progfay/scrapbox-parser package before 6.0.3 for Node.js. |
2021-02-19 |
not yet calculated |
CVE-2021-27405
MISC
MISC
MISC |
| node.js — node.js |
The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring. |
2021-02-19 |
not yet calculated |
CVE-2021-3189
MISC
MISC |
node.js — node.js
|
The System Information Library for Node.JS (npm package “systeminformation”) is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() … do only allow strings, reject any arrays. String sanitation works as expected. |
2021-02-16 |
not yet calculated |
CVE-2021-21315
MISC
CONFIRM
MISC |
ondemand — ondemand
|
Open OnDemand before 1.5.7 and 1.6.x before 1.6.22 allows CSRF. |
2021-02-19 |
not yet calculated |
CVE-2020-36247
MISC |
opc_ua.net — opc_ua.net
|
A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates. |
2021-02-16 |
not yet calculated |
CVE-2020-29457
MISC
CONFIRM
MISC |
opencast — opencast
|
Opencast is a free, open-source platform to support the management of educational audio and video content. In Opencast before version 9.2 there is a vulnerability in which publishing an episode with strict access rules will overwrite the currently set series access. This allows for an easy denial of access for all users without superuser privileges, effectively hiding the series. Access to series and series metadata on the search service (shown in media module and player) depends on the events published which are part of the series. Publishing an event will automatically publish a series and update access to it. Removing an event or republishing the event should do the same. Affected versions of Opencast may not update the series access or remove a published series if an event is being removed. On removal of an episode, this may lead to an access control list for series metadata with broader access rules than the merged access rules of all remaining events, or the series metadata still being available although all episodes of that series have been removed. This problem is fixed in Opencast 9.2. |
2021-02-18 |
not yet calculated |
CVE-2021-21318
MISC
CONFIRM |
openemr — openemr
|
A SQL injection vulnerability in interface/reports/immunization_report.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter. |
2021-02-15 |
not yet calculated |
CVE-2020-29140
MISC
MISC
MISC
MISC
MISC |
openemr — openemr
|
A SQL injection vulnerability in interface/reports/non_reported.php in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the form_code parameter. |
2021-02-15 |
not yet calculated |
CVE-2020-29143
MISC
MISC
MISC
MISC |
openemr — openemr
|
A SQL injection vulnerability in interface/main/finder/patient_select.php from library/patient.inc in OpenEMR before 5.0.2.5 allows a remote authenticated attacker to execute arbitrary SQL commands via the searchFields parameter. |
2021-02-15 |
not yet calculated |
CVE-2020-29139
MISC
MISC
MISC
MISC |
openldap — openldap
|
In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. |
2021-02-14 |
not yet calculated |
CVE-2021-27212
MISC
MISC
MISC
MLIST |
opennms — meridian
|
OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions. |
2021-02-17 |
not yet calculated |
CVE-2021-3396
MISC
CONFIRM |
openrepeater — openrepeater
|
OpenRepeater (ORP) before 2.2 allows unauthenticated command injection via shell metacharacters in the functions/ajax_system.php post_service parameter. |
2021-02-19 |
not yet calculated |
CVE-2019-25024
MISC
MISC |
| openssl — opensll |
The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). |
2021-02-16 |
not yet calculated |
CVE-2021-23841
CONFIRM
CONFIRM
CONFIRM
DEBIAN
CONFIRM |
openssl — opensll
|
Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x). |
2021-02-16 |
not yet calculated |
CVE-2021-23840
CONFIRM
CONFIRM
CONFIRM
DEBIAN
CONFIRM |
openssl — openssl
|
OpenSSL 1.0.2 supports SSLv2. If a client attempts to negotiate SSLv2 with a server that is configured to support both SSLv2 and more recent SSL and TLS versions then a check is made for a version rollback attack when unpadding an RSA signature. Clients that support SSL or TLS versions greater than SSLv2 are supposed to use a special form of padding. A server that supports greater than SSLv2 is supposed to reject connection attempts from a client where this special form of padding is present, because this indicates that a version rollback has occurred (i.e. both client and server support greater than SSLv2, and yet this is the version that is being requested). The implementation of this padding check inverted the logic so that the connection attempt is accepted if the padding is present, and rejected if it is absent. This means that such as server will accept a connection if a version rollback attack has occurred. Further the server will erroneously reject a connection if a normal SSLv2 connection attempt is made. Only OpenSSL 1.0.2 servers from version 1.0.2s to 1.0.2x are affected by this issue. In order to be vulnerable a 1.0.2 server must: 1) have configured SSLv2 support at compile time (this is off by default), 2) have configured SSLv2 support at runtime (this is off by default), 3) have configured SSLv2 ciphersuites (these are not in the default ciphersuite list) OpenSSL 1.1.1 does not have SSLv2 support and therefore is not vulnerable to this issue. The underlying error is in the implementation of the RSA_padding_check_SSLv23() function. This also affects the RSA_SSLV23_PADDING padding mode used by various other functions. Although 1.1.1 does not support SSLv2 the RSA_padding_check_SSLv23() function still exists, as does the RSA_SSLV23_PADDING padding mode. Applications that directly call that function or use that padding mode will encounter this issue. However since there is no support for the SSLv2 protocol in 1.1.1 this is considered a bug and not a security issue in that version. OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.0.2y (Affected 1.0.2s-1.0.2x). |
2021-02-16 |
not yet calculated |
CVE-2021-23839
CONFIRM
CONFIRM
CONFIRM |
| owncloud — owncloud |
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past. |
2021-02-19 |
not yet calculated |
CVE-2020-36250
MISC |
| owncloud — owncloud |
ownCloud Server 10.x before 10.3.1 allows an attacker, who has one outgoing share from a victim, to access any version of any file by sending a request for a predictable ID number. |
2021-02-19 |
not yet calculated |
CVE-2020-36252
MISC |
owncloud — owncloud
|
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else’s access to that share. |
2021-02-19 |
not yet calculated |
CVE-2020-36251
MISC |
owncloud — owncloud
|
The File Firewall before 2.8.0 for ownCloud Server does not properly enforce file-type restrictions for public shares. |
2021-02-19 |
not yet calculated |
CVE-2020-36249
MISC |
owncloud — owncloud
|
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive. |
2021-02-19 |
not yet calculated |
CVE-2020-36248
MISC |
owncloud — owncloud
|
An issue was discovered in ownCloud before 10.4. An attacker can bypass authentication on a password-protected image by displaying its preview. |
2021-02-19 |
not yet calculated |
CVE-2020-10254
MISC
CONFIRM
MISC |
owncloud — owncloud
|
An issue was discovered in ownCloud before 10.4. Because of an SSRF issue (via the apps/files_sharing/external remote parameter), an authenticated attacker can interact with local services blindly (aka Blind SSRF) or conduct a Denial Of Service attack. |
2021-02-19 |
not yet calculated |
CVE-2020-10252
MISC
CONFIRM
MISC |
pelco — digital_sentry_server
|
The RTSPLive555.dll ActiveX control in Pelco Digital Sentry Server 7.18.72.11464 has a SetCameraConnectionParameter stack-based buffer overflow. This can be exploited by a remote attacker to potentially execute arbitrary attacker-supplied code. The victim would have to visit a malicious webpage using Internet Explorer where the exploit could be triggered. |
2021-02-16 |
not yet calculated |
CVE-2021-27232
MISC
MISC |
phpgurukul — car_rental_project
|
PHPGurukul Car Rental Project version 2.0 suffers from a remote shell upload vulnerability in changeimage1.php. |
2021-02-17 |
not yet calculated |
CVE-2021-26809
MISC
MISC |
| pi-hole — pi-hole |
Pi-hole 5.0, 5.1, and 5.1.1 allows XSS via the Options header to the admin/ URI. A remote user is able to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against other users and steal the session cookie. |
2021-02-18 |
not yet calculated |
CVE-2020-35592
MISC
MISC |
pi-hole — pi-hole
|
Pi-hole 5.0, 5.1, and 5.1.1 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user’s account through the active session. |
2021-02-18 |
not yet calculated |
CVE-2020-35591
MISC
MISC |
pimcore — pimcore
|
This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability. |
2021-02-18 |
not yet calculated |
CVE-2021-23340
MISC
MISC
MISC |
pnglmg — pnglmg
|
An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file. |
2021-02-20 |
not yet calculated |
CVE-2020-28248
MISC
MISC
MISC
MISC |
powerlogic — multiple_products
|
A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause a user to perform an unintended action on the target device when using the HTTP web interface. |
2021-02-19 |
not yet calculated |
CVE-2021-22701
MISC |
powerlogic — multiple_products
|
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device. |
2021-02-19 |
not yet calculated |
CVE-2021-22703
MISC |
powerlogic — multiple_products
|
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device. |
2021-02-19 |
not yet calculated |
CVE-2021-22702
MISC |
pressbooks — pressbooks
|
PressBooks 5.17.3 contains a cross-site scripting (XSS). Stored XSS can be submitted via the Book Info’s Long Description Body, and all actions to open or preview the books page will result in the triggering the stored XSS. |
2021-02-18 |
not yet calculated |
CVE-2021-3271
MISC
MISC
MISC |
prism-asciidoc — prism-asciidoc
|
The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components. |
2021-02-18 |
not yet calculated |
CVE-2021-23341
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRM
CONFIRM |
property_management_system — property_management_system
|
Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions. |
2021-02-17 |
not yet calculated |
CVE-2021-22858
CONFIRM
MISC |
prototye_pollution — prototype_pollution
|
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge . |
2021-02-18 |
not yet calculated |
CVE-2020-28499
CONFIRM
CONFIRM
CONFIRM |
qlib — qlib
|
This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function. |
2021-02-15 |
not yet calculated |
CVE-2021-23338
MISC
MISC |
qnap — nas_devices
|
A stack-based buffer overflow vulnerability has been reported to affect QNAP NAS devices running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. QNAP have already fixed this vulnerability in the following versions: Surveillance Station 5.1.5.4.3 (and later) for ARM CPU NAS (64bit OS) and x86 CPU NAS (64bit OS) Surveillance Station 5.1.5.3.3 (and later) for ARM CPU NAS (32bit OS) and x86 CPU NAS (32bit OS) |
2021-02-17 |
not yet calculated |
CVE-2020-2501
MISC |
qnap — photo_station
|
This cross-site scripting vulnerability in Photo Station allows remote attackers to inject malicious code. QANP We have already fixed this vulnerability in the following versions of Photo Station. Photo Station 6.0.11 and later |
2021-02-17 |
not yet calculated |
CVE-2020-2502
MISC |
| racom — midge_firmware |
Racom’s MIDGE Firmware 4.4.40.105 contains an issue that allows users to escape the provided command line interface and execute arbitrary OS commands. |
2021-02-16 |
not yet calculated |
CVE-2021-20074
MISC |
racom — midge_firmware
|
Racom’s MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to view sensitive syslog events without authentication. |
2021-02-16 |
not yet calculated |
CVE-2021-20067
MISC |
racom — midge_firmware
|
Racom’s MIDGE Firmware 4.4.40.105 contains an issue that allows for cross-site request forgeries. |
2021-02-16 |
not yet calculated |
CVE-2021-20073
MISC |
racom — midge_firmware
|
Racom’s MIDGE Firmware 4.4.40.105 contains an issue that allows attackers to arbitrarily access and delete files via an authenticated directory traveral. |
2021-02-16 |
not yet calculated |
CVE-2021-20072
MISC |
reportlab — reportlab
|
All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab’s documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=”http://127.0.0.1:5000″ valign=”top”/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF |
2021-02-18 |
not yet calculated |
CVE-2020-28463
CONFIRM
CONFIRM |
| rust — rust |
An issue was discovered in the yottadb crate before 1.2.0 for Rust. For some memory-allocation patterns, ydb_subscript_next_st and ydb_subscript_prev_st have a use-after-free. |
2021-02-18 |
not yet calculated |
CVE-2021-27377
MISC |
rust — rust
|
An issue was discovered in the nb-connect crate before 1.0.3 for Rust. It may have invalid memory access for certain versions of the standard library because it relies on a direct cast of std::net::SocketAddrV4 and std::net::SocketAddrV6 data structures. |
2021-02-18 |
not yet calculated |
CVE-2021-27376
MISC |
rust — rust
|
An issue was discovered in the rand_core crate before 0.6.2 for Rust. Because read_u32_into and read_u64_into mishandle certain buffer-length checks, a random number generator may be seeded with too little data. |
2021-02-18 |
not yet calculated |
CVE-2021-27378
MISC |
| sangoma — asterisk |
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash. |
2021-02-18 |
not yet calculated |
CVE-2021-26717
MISC
FULLDISC
MISC
CONFIRM
CONFIRM |
sangoma — asterisk
|
A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch. |
2021-02-19 |
not yet calculated |
CVE-2021-26713
MISC
MISC
MISC |
sangoma — asterisk
|
A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses. |
2021-02-18 |
not yet calculated |
CVE-2020-35776
MISC
FULLDISC
CONFIRM
MISC
CONFIRM |
sangoma — asterisk
|
Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets. |
2021-02-18 |
not yet calculated |
CVE-2021-26712
MISC
FULLDISC
MISC
CONFIRM
CONFIRM |
| secomea — gatemanager |
An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c |
2021-02-15 |
not yet calculated |
CVE-2020-29031
MISC |
secomea — gatemanager
|
A directory traversal vulnerability exists in the file upload function of the GateManager that allows an authenticated attacker with administrative permissions to read and write arbitrary files in the Linux file system. This issue affects: GateManager all versions prior to 9.2c. |
2021-02-15 |
not yet calculated |
CVE-2020-29026
MISC |
secomea — gatemanager
|
Sensitive Cookie in HTTPS Session Without ‘Secure’ Attribute vulnerability in (GTA) GoToAppliance of Secomea GateManager could allow an attacker to gain access to sensitive cookies. This issue affects: Secomea GateManager all versions prior to 9.3. |
2021-02-16 |
not yet calculated |
CVE-2020-29024
MISC |
secomea — gatemanager
|
Improper Encoding or Escaping of Output from CSV Report Generator of Secomea GateManager allows an authenticated administrator to generate a CSV file that may run arbitrary commands on a victim’s computer when opened in a spreadsheet program (like Excel). This issue affects: Secomea GateManager all versions prior to 9.3. |
2021-02-16 |
not yet calculated |
CVE-2020-29023
MISC
CONFIRM |
secomea — gatemanager
|
Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3 |
2021-02-16 |
not yet calculated |
CVE-2020-29022
MISC |
smartstorenet — smartstorenet
|
An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/customer/create to create an admin account). |
2021-02-19 |
not yet calculated |
CVE-2020-27997
MISC
MISC |
| soar — cloud_system |
The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands. |
2021-02-17 |
not yet calculated |
CVE-2021-22855
CONFIRM
MISC |
soar — cloud_system
|
The HR Portal of Soar Cloud System fails to manage access control. While obtaining user ID, remote attackers can access sensitive data via a specific data packet, such as user’s login information, further causing the login function not to work. |
2021-02-17 |
not yet calculated |
CVE-2021-22853
CONFIRM
MISC |
soar — cloud_system
|
The HR Portal of Soar Cloud System fails to filter specific parameters. Remote attackers can inject SQL syntax and obtain all data in the database without privilege. |
2021-02-17 |
not yet calculated |
CVE-2021-22854
CONFIRM
MISC |
steghide — steghide
|
steghide 0.5.1 relies on a certain 32-bit seed value, which makes it easier for attackers to detect hidden data. |
2021-02-15 |
not yet calculated |
CVE-2021-27211
MISC
MISC
MISC |
sytech — xl_reporter
|
An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directory. Depending on the vector chosen, an attacker can overwrite service executables and execute arbitrary code with privileges of user set to run the service or replace other files within the installation folder, which would allow for local privilege escalation. |
2021-02-19 |
not yet calculated |
CVE-2020-13549
MISC |
teachers_record_management_system — teachers_record_management_system
|
Teachers Record Management System 1.0 is affected by a SQL injection vulnerability in ‘searchteacher’ POST parameter in search-teacher.php. This vulnerability can be exploited by a remote unauthenticated attacker to leak sensitive information and perform code execution attacks. |
2021-02-15 |
not yet calculated |
CVE-2021-26822
MISC
MISC |
telsa — solarcity_solar_monitoring_gateway
|
Tesla SolarCity Solar Monitoring Gateway through 5.46.43 has a “Use of Hard-coded Credentials” issue because Digi ConnectPort X2e uses a .pyc file to store the cleartext password for the python user account. |
2021-02-18 |
not yet calculated |
CVE-2020-9306
CONFIRM
MISC
MISC
MISC |
testes_de_codigo — testes_de_codigo
|
Mobile application “Testes de Codigo” 11.4 and prior allows an attacker to gain access to the administrative interface and premium features by tampering the boolean value of parameters “isAdmin” and “isPremium” located on device storage. |
2021-02-16 |
not yet calculated |
CVE-2021-25648
MISC |
three — three
|
This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require(‘three’) function build_blank (n) { var ret = “rgb(” for (var i = 0; i < n; i++) { ret += ” ” } return ret + “”; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() – time; console.log(time_cost+” ms”) |
2021-02-18 |
not yet calculated |
CVE-2020-28496
MISC
MISC
MISC
MISC |
traefik — traefik
|
Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. |
2021-02-18 |
not yet calculated |
CVE-2021-27375
MISC
CONFIRM |
uap-core — uap-core
|
uap-core in an open-source npm package which contains the core of BrowserScope’s original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes. |
2021-02-16 |
not yet calculated |
CVE-2021-21317
MISC
CONFIRM
MISC |
uprism — uprism
|
A vulnerability of uPrism.io CURIX(Video conferecing solution) could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient input(server domain) validation. An attacker could exploit this vulnerability through crafted URL. |
2021-02-17 |
not yet calculated |
CVE-2020-7849
MISC |
vertigis — weboffice
|
VertiGIS WebOffice 10.7 SP1 before patch20210202 and 10.8 SP1 before patch20210207 allows attackers to achieve “Zugriff auf Inhalte der WebOffice Applikation.” |
2021-02-17 |
not yet calculated |
CVE-2021-27374
MISC
MISC |
visualware — myconnection_server
|
In Visualware MyConnection Server before 11.0b build 5382, each published report is not associated with its own access code. |
2021-02-19 |
not yet calculated |
CVE-2021-27509
MISC |
voloko– twitter-stream
|
In voloko twitter-stream 0.1.10, missing TLS hostname validation allows an attacker to perform a man-in-the-middle attack against users of the library (because eventmachine is misused). |
2021-02-19 |
not yet calculated |
CVE-2020-24392
MISC
MISC |
voloko– twitter-stream
|
TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack. |
2021-02-19 |
not yet calculated |
CVE-2020-24393
MISC
MISC |
webware — webdesktop
|
SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server. |
2021-02-19 |
not yet calculated |
CVE-2021-3204
MISC |
wireshark — wireshark
|
Crash in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
2021-02-17 |
not yet calculated |
CVE-2021-22174
CONFIRM
MISC
MISC |
wireshark — wireshark
|
Memory leak in USB HID dissector in Wireshark 3.4.0 to 3.4.2 allows denial of service via packet injection or crafted capture file |
2021-02-17 |
not yet calculated |
CVE-2021-22173
CONFIRM
MISC
MISC |
xen — xen
|
An issue was discovered in Xen through 4.11.x, allowing x86 Intel HVM guest OS users to achieve unintended read/write DMA access, and possibly cause a denial of service (host OS crash) or gain privileges. This occurs because a backport missed a flush, and thus IOMMU updates were not always correct. NOTE: this issue exists because of an incomplete fix for CVE-2020-15565. |
2021-02-18 |
not yet calculated |
CVE-2021-27379
MISC |
| yeastar — neogate_devices |
Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such as a password or decryption key. |
2021-02-19 |
not yet calculated |
CVE-2021-27328
MISC
MISC |
zoho — manageengine_adselfservice_plus
|
A Server-side request forgery (SSRF) vulnerability in the ProductConfig servlet in Zoho ManageEngine ADSelfService Plus through 6013 allows a remote unauthenticated attacker to perform blind HTTP requests or perform a Cross-site scripting (XSS) attack against the administrative interface via an HTTP request, a different vulnerability than CVE-2019-3905. |
2021-02-19 |
not yet calculated |
CVE-2021-27214
MISC
MISC |
![MAR-10322463-3.v1 – AppleJeus: Union Crypto]()
by Scott Muniz | Feb 17, 2021 | Security, Technology
This article is contributed. See the original author and article here.
Malware Analysis Report
10322463.r3.v1
2021-02-12
Notification
This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.
This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.
Summary
Description
This Malware Analysis Report (MAR) is the result of analytic efforts among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) to highlight the cyber threat to cryptocurrency posed by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK), and provide mitigation recommendations. Working with U.S. government partners, FBI, CISA, and Treasury assess that Lazarus Group—which these agencies attribute to North Korean state-sponsored advanced persistent threat (APT) actors—is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.
This MAR highlights this cyber threat posed by North Korea and provides detailed indicators of compromise (IOCs) used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on other versions of AppleJeus and recommended steps to mitigate this threat, see Joint Cybersecurity Advisory AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware at https://www.us-cert.cisa.gov/ncas/alerts/AA21-048A.
There have been multiple versions of AppleJeus malware discovered since its initial discovery in August 2018. In most versions, the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.
The U.S. Government has identified AppleJeus malware version—Union Crypto—and associated IOCs used by the North Korean government in AppleJeus operations.
Union Crypto, discovered by a cybersecurity company in December 2019, is a legitimate-looking cryptocurrency trading software that is marketed and distributed by a company and website—Union Crypto and unioncrypto[.]vip, respectively—that appear legitimate.
For a downloadable copy of IOCs, see: MAR-10322463-3.v1.stix.
Submitted Files (8)
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f (UnionCryptoUpdater.exe)
0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 (UnionCryptoTrader.exe)
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 (UnionCryptoTrader.dmg)
631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 (unioncryptoupdater)
6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 (UnionCryptoTrader)
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 (NodeDLL.dll)
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 (UnionCryptoTrader.msi)
e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 (UnionCryptoSetup.exe)
Domains (1)
unioncrypto.vip
IPs (1)
216.189.150.185
Findings
e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774
Tags
trojan
Details
| Name |
UnionCryptoSetup.exe |
| Size |
30330443 bytes |
| Type |
PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 |
24b3614d5c5e53e40b42b4e057001770 |
| SHA1 |
b040433fb50d679b2e287d7fcc1667a415fb60b0 |
| SHA256 |
e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 |
| SHA512 |
55e9c7f59189e395b6b348d9fa8b4b907d0cedd790a33603a49ac857f5a07b205f8787fab0c7a9954e992852e6e5090f3cbf2243e86bb2546bd5628619648d87 |
| ssdeep |
786432:Dj2fi5nBGPBMNekleUtOaZ13vcdkIXX0kfp:+65AP+QAeUtOKvc+c0kR |
| Entropy |
7.984564 |
Antivirus
| Filseclab |
W32.ELEX.L.erpg.mg |
| Microsoft Security Essentials |
Trojan:Win32/UnionCryptoTrader!ibt |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
PE Metadata
| Compile Date |
2018-09-20 09:08:01-04:00 |
| Import Hash |
cbc19a820310308f17b0a7c562d044e0 |
| Company Name |
UnionCrypto Co.Ltd |
| File Description |
Union Crypto Trader |
| Internal Name |
UnionCryptoTraderSetup.exe |
| Legal Copyright |
© UnionCrypto Corporation. All Rights Reserved. |
| Original Filename |
UnionCryptoTraderSetup.exe |
| Product Name |
Union Crypto Trader |
| Product Version |
1.0.23.474 |
PE Sections
| MD5 |
Name |
Raw Size |
Entropy |
| 566abfd43bde6dda239bf28ac9b087ae |
header |
1024 |
2.960546 |
| 764b34cabee1111c9e11c8f836aebafb |
.text |
608256 |
6.539792 |
| 7989312225f01ce65374248a3e73a557 |
.rdata |
189440 |
4.588598 |
| 1ac52732b5e747734a833e523cd8f27f |
.data |
10240 |
4.418143 |
| 3afae9bb129e782e05f70b3416946646 |
.rsrc |
434688 |
6.340500 |
| d11bf51446bb40b38f82ba6ce1f57dc4 |
.reloc |
162816 |
2.478756 |
Packers/Compilers/Cryptors
Relationships
| e3623c2440… |
Contains |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
Description
This Windows program from the Union Crypto Trader site is a Windows executable. This executable is actually an installer, and will first extract a temporary MSI named UnionCryptoTrader.msi (af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49) to the “C:Users<username>AppDataLocalTemp{82E4B719-90F7-4BD1-9CF1-56CD777E0C42}” folder, which will be executed by “UnionCryptoTraderSetup.exe” and deleted after it successfully completes the installation.
unioncrypto.vip
Tags
command-and-control
URLs
- hxxps[:]//unioncrypto.vip/update
- hxxps[:]//www[.]unioncrypto.vip/download/W6c2dq8By7luMhCmya2v97YeN
Whois
Whois for unioncrypto.vip had the following information on December 8, 2019:
Registrar: NameCheap
Created: June 5, 2019
Expires: June 5, 2020
Updated: June 5, 2019
Relationships
| unioncrypto.vip |
Downloaded_To |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
| unioncrypto.vip |
Downloaded_To |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
Description
While this site is no longer available, a download link of hxxps[:]//www[.]unioncrypto.vip/download/W6c2dq8By7luMhCmya2v97YeN was discovered by a cyber-security researcher and is recorded on VirusTotal for the OSX version of UnionCryptoTrader. In contrast, open source reporting disclosed the Windows version may have been downloaded via Telegram, as it was found in a “Telegram Downloads” folder on an unnamed victim. Union Crypto Trader has a legitimately signed Sectigo SSL certificate, which was “Domain Control Validated” just as the previous version certificates. .
The domain is registered with NameCheap at the IP address 104.168.167.16 with ASN 54290.
Screenshots
Figure 1 – Screenshot of the Union Crypto Trader website.
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49
Tags
dropper
Details
| Name |
UnionCryptoTrader.msi |
| Size |
14634496 bytes |
| Type |
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Number of Characters: 0, Last Saved By: InstallShield, Number of Words: 0, Title: Union Crypto Trader, Comments: Contact: Your local administrator, Keywords: Installer, Subject: Smart Cryptocurrency Arbitrage Trading Platform, Author: UnionCryptoTrader, Security: 1, Number of Pages: 200, Name of Creating Application: InstallShield 2018 – Premier Edition with Virtualization Pack 24, Last Saved Time/Date: Tue Aug 6 23:59:58 2019, Create Time/Date: Tue Aug 6 23:59:58 2019, Last Printed: Tue Aug 6 23:59:58 2019, Revision Number: {44311F94-C85D-4688-996A-4888F2D32062}, Code page: 1252, Template: x64;1033 |
| MD5 |
0f03ec3487578cef2398b5b732631fec |
| SHA1 |
349fb7c922fba6da4bf5c2a3a9e0735f11068dac |
| SHA256 |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
| SHA512 |
f2aa24d96daf090f3a29b5536f3ce0a9a59171b7fdb85887bc32ea6c5305e5ee03153b2c402399dd05a28d6fa90a3e979cc8153fd69686b5bbbb4ec199b8f2b3 |
| ssdeep |
393216:zDea98QM1lKTmbHJdgXuUSCve2TN4ksIVVYlm6j8ziFS:XeanAKTuHbd9Ye2qpj8Og |
| Entropy |
7.948615 |
Antivirus
| TrendMicro |
TROJ_FR.DEFD7DB1 |
| TrendMicro House Call |
TROJ_FR.DEFD7DB1 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| af4144c1f0… |
Contained_Within |
e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 |
| af4144c1f0… |
Contains |
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f |
| af4144c1f0… |
Contains |
0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 |
Description
This Windows program is a Windows MSI Installer. The MSI installer will install “UnionCryptoTrader.exe”(0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36) in the “C:Program FilesUnionCryptoTrader” folder and also install UnionCryptoUpdater.exe (01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f) in the “C:Users<username>AppDataLocalUnionCryptoTrader” folder. Immediately after installation, the installer launches “UnionCryptoUpdater.exe.”
Screenshots
Figure 2 – Screenshot of the UnionCryptoTrader Installation.
0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36
Tags
trojan
Details
| Name |
UnionCryptoTrader.exe |
| Size |
1286144 bytes |
| Type |
PE32+ executable (GUI) x86-64, for MS Windows |
| MD5 |
46b3061fe981d0a5edfd8d55f75adf9f |
| SHA1 |
514263acf79aeb49d87192ae08f6c76854cdda12 |
| SHA256 |
0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 |
| SHA512 |
38418a2f3a8870352d8a88d6fb48e2c93a35b48a559590beb12c7c507eadfd07bf087ea11e822fc3e7bc9d6710b17cb68c416ffcf87a787ed9428f2c6b56413e |
| ssdeep |
24576:fnrKym9OWCy0frP+1obeVbK8KW/TJ9+FCPjjcym8MUml:fnrKb9OWCy0q1obeVbPKW/TKcjlmhUml |
| Entropy |
6.414530 |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
No matches found.
PE Metadata
| Compile Date |
2019-08-06 21:22:00-04:00 |
| Import Hash |
e0f869ddf0b356ab31c5676591e890ed |
| Company Name |
UnionCrypto Co.Ltd |
| File Description |
Union Crypto Trader |
| Internal Name |
UnionCryptoTrader.exe |
| Legal Copyright |
© UnionCrypto Corporation. All rights reserved. |
| Original Filename |
UnionCryptoTrader.exe |
| Product Name |
Union Crypto Trader |
| Product Version |
1.00.0000 |
PE Sections
| MD5 |
Name |
Raw Size |
Entropy |
| 8a496cd41319fdb127a000e7a43bdfd4 |
header |
1024 |
3.518197 |
| 686f2fe8e51a4327d3e25e937c5eb1cc |
.text |
878080 |
6.431878 |
| 8f5b24579aaf7ecbc95b26614cf51e8c |
.rdata |
230912 |
5.566823 |
| 91b3d6678654de37caa94b211aae696e |
.data |
15360 |
4.052861 |
| af667013369aea1785ada0e5442bcf07 |
.pdata |
41472 |
6.082142 |
| aced93d352d733478dc51a779aef0c62 |
.gfids |
512 |
0.317810 |
| 1f354d76203061bfdd5a53dae48d5435 |
.tls |
512 |
0.020393 |
| 285d8a234d06cfb54adffe2eb077a2fe |
.rsrc |
113664 |
3.831914 |
| 241aeb18e88145608a8b273404896f72 |
.reloc |
4608 |
5.365584 |
Packers/Compilers/Cryptors
| Microsoft Visual C++ 8.0 (DLL) |
Relationships
| 0967d2f122… |
Contained_Within |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
Description
This file is a 64-bit Windows executable contained within the Windows MSI Installer “UnionCryptoTrader.msi.” When executed, “UnionCryptoTrader.exe” loads a legitimate cryptocurrency arbitrage application with no signs of malicious activity. (Note: arbitrage is defined as “the simultaneous buying and selling of securities, currency, or commodities in different markets or in derivative forms in order to take advantage of differing prices for the same asset”).
This application does not appear to be a modification of the Windows QT Bitcoin Trader, but may be a modification of Blackbird Bitcoin Arbitrage.
In addition to the “unioncrypto.vip” site describing “UnionCryptoTrader.exe” as a “Smart Cryptocurrency Arbitrage Trading Platform,” many of the strings found in “UnionCryptoTrader.exe” have references to Blackbird Bitcoin Arbitrage including but not limited to:
–Begin similarities–
Blackbird Bitcoin Arbitrage
| Blackbird Bitcoin Arbitrage Log File |
output/blackbird_result_
outputblackbird_log_
ERROR: Blackbird needs at least two Bitcoin exchanges. Please edit the config.json file to add new exchanges
–End similarities–
The strings also contain the links and references to all fourteen exchanges listed as implemented or potential on the Blackbird GitHub page. In addition, the “config.txt” file found in the “C:Program FilesUnionCryptoTrader” folder with “UnionCryptoTrader.exe” also contains references to all fourteen exchanges, as well as sets the database file to “blackbird.db.” The file “blackbird.db” is also found in the same folder.
Screenshots
Figure 3 – Screenshot of the “UnionCryptoTrader.exe”application.
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f
Tags
trojan
Details
| Name |
UnionCryptoUpdater.exe |
| Size |
161280 bytes |
| Type |
PE32+ executable (console) x86-64, for MS Windows |
| MD5 |
629b9de3e4b84b4a0aa605a3e9471b31 |
| SHA1 |
1ef0e1cabd344726b663cec8d9e68f147259da55 |
| SHA256 |
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f |
| SHA512 |
c70abbe52cbbed220fee218664d1c5f4313bd5387de11c275aa31115e90328dac032c6138954f3931c7d134e8613ad6c278ed29d78c0dc8199a1433b1a106132 |
| ssdeep |
3072:Q/MdytyORF471FiHNkwBFTdpSI94e1ZVypzCG9n7r:Q/ftvF471AHNFjdYIZOt |
| Entropy |
6.192246 |
Antivirus
| Avira |
TR/Agent.pfpad |
| BitDefender |
Trojan.GenericKD.33626108 |
| Comodo |
Malware |
| ESET |
a variant of Win64/Agent.UV trojan |
| Emsisoft |
Trojan.GenericKD.33626108 (B) |
| Ikarus |
Trojan.Win64.Agent |
| K7 |
Trojan ( 0056425b1 ) |
| Lavasoft |
Trojan.GenericKD.33626108 |
| McAfee |
Trojan-Agent.c |
| NANOAV |
Trojan.Win64.Mlw.icfhya |
| Symantec |
Trojan.Gen.2 |
| TACHYON |
Trojan/W64.Agent.161280.C |
| TrendMicro |
TROJ_FR.DEFD7DB1 |
| TrendMicro House Call |
TROJ_FR.DEFD7DB1 |
| VirusBlokAda |
Trojan.Win64.Agentb |
| Zillya! |
Trojan.Agent.Win64.5106 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
PE Metadata
| Compile Date |
2019-08-06 22:00:26-04:00 |
| Import Hash |
e217501515a13bba8aefe7dcf3b74f33 |
| Company Name |
UnionCrypto Co.Ltd |
| File Description |
Union Crypto Trading Updater |
| Internal Name |
unioncryptoupdater.exe |
| Legal Copyright |
© UnionCrypto Corporation. All rights reserved. |
| Original Filename |
unioncryptoupdater.exe |
| Product Name |
Union Crypto Trading Updater |
| Product Version |
1.0.23.474 |
PE Sections
| MD5 |
Name |
Raw Size |
Entropy |
| 9b73650178bdd95af246609c1b650253 |
header |
1024 |
3.045187 |
| ac3f61418ff1daa9142e2304a647c2aa |
.text |
98816 |
6.452850 |
| cc2de13f05d38702ac9a560e450ab54a |
.rdata |
48128 |
5.088494 |
| 20ef8fb99461ca48fe9ed26ffb4cc26c |
.data |
3072 |
2.234569 |
| abf07cda1f35bf5fe4a9ac21de63f903 |
.pdata |
6144 |
5.155358 |
| 3eab486bdf211a98334f08a5145dbf94 |
.gfids |
512 |
1.857174 |
| c9ab77353b20e3b22c344b60c8859d56 |
.rsrc |
1536 |
3.943344 |
| a9cd219d9ad71f6c2c60efc1308885c8 |
.reloc |
2048 |
4.924725 |
Packers/Compilers/Cryptors
| Microsoft Visual C++ 8.0 (DLL) |
Relationships
| 01c13f825e… |
Downloaded |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
| 01c13f825e… |
Contained_Within |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
Description
This file is a 64-bit Windows executable contained within the Windows MSI Installer “UnionCryptoTrader.msi.” When executed, “UnionCryptoUpdater.exe” first installs itself as a service, which will automatically start when any user logs on. The service is installed with a description stating it “Automatically installs updates for Union Crypto Trader.”
After installing the service, “UnionCryptoUpdater.exe” collects different information about the system the malware is running on. Specifically, it uses Windows Management Instrumentation (WMI) Query Language (WQL) to collect this information. “UnionCryptoUpdater.exe” first finds the BIOS Serial Number by using the “SELECT * FROM Win32_Bios” WMI filter as a WQL Query String (Figure 4).
This returns SMBBIOSBIOSVersion, Manufacturer, Name, SerialNumber, and Version. The function later pulls the “SerialNumber” from this returned data (Figure 5).
The same process is followed to pull the operating system version and build number. The WQL Query String is “SELECT * FROM Win32_OperatingSystem,” and the fields pulled are “Caption” and “BuildNumber.” Note that the “Caption” field contains the OS version for the computer running the malware.
After collecting the system data, “UnionCryptoUpdater.exe” then builds a string consisting of the current time and the hard-coded value “12GWAPCT1F0I1S14.” The current time is stored in the “auth_timestamp” variable.
This combined string is MD5 hashed and stored in the “auth_signature” variable. These variables are sent in the first communication to the command and control (C2) server, and are likely used to verify any connections to the server are actually originating from the “UnionCryptoUpdater.exe” malware.
These variables are sent via a POST the C2 hxxps[:]//unioncrypto.vip/update along with the collected system data. The system data is sent in this specific format:
–Begin format–
rlz=[BIOS serial number]&ei=[OS Version] (BuildNumber)&act=check
–End format–
These values, along with a hard-coded User Agent String of “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36” can be found in the malware data section.
If the POST is successful (i.e. returns an HTTP response status code of 200), but returns a string of “0”, UnionCryptoUpdater.exe will sleep for ten minutes and then regenerate the “auth_timestamp” and “auth_signature” to contact the C2 again.
If the POST is successful and the C2 server does not return the string “0”, the malware will decode the base64 payload and decrypt it. It then uses built in C++ functions to allocate memory, write the payload to memory, and executes the payload. If this is successful, the malware will send another POST to the C2 with the value “act=done” replacing the “act=check” for the previously specified format (Figure 9).
Screenshots
Figure 4 – Screenshot of the “UnionCryptoUpdater” Service.
Figure 5 – Screenshot of the “SELECT * FROM Win32_Bios” query string.
Figure 6 – Screenshot of the “SerialNumber” selection.
Figure 7 – Screenshot of the “UnionCryptoUpdater.exe” getting current time and combining with hard-coded value.
Figure 8 – Screenshot of the hard-coded values and User Agent in “UnionCryptoUpdater.exe.”
Figure 9 – Screenshot of the hard-coded “&act=done” value.
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3
Tags
trojan
Details
| Name |
NodeDLL.dll |
| Size |
537616 bytes |
| Type |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| MD5 |
549db64ceaebbbdd9068d761cb5c616c |
| SHA1 |
6d91ce7b9f38e2316aa9fb50ececc02eadc4cd70 |
| SHA256 |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
| SHA512 |
0281257ad97e0765b57d29bb22fe9973f4ad5c42a93762eda1b12e71f78d02155fe32eda4ccd4acadbfccf61563175c28c520df5b631698573422048dce6a8c0 |
| ssdeep |
12288:FOvSQSQs75paRGK9EovEfM9NosCz4jcauwVyZE19QLC:Mv0VpkGYvI6NAz4j5LV6+ |
| Entropy |
6.433002 |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
No matches found.
PE Metadata
| Compile Date |
2019-10-21 12:33:45-04:00 |
| Import Hash |
c24e1d44f912d970e41414c324d04158 |
PE Sections
| MD5 |
Name |
Raw Size |
Entropy |
| 41f1664ee936eb5e9c5a402b9f791086 |
header |
1024 |
3.215046 |
| d7c3e5262e243bfd078cc689c0dcc509 |
.text |
393728 |
6.418398 |
| 0155d4e1f35b8f139d07993866f1e2f6 |
.rdata |
115200 |
5.560875 |
| 67b68408aebc7de9f6019e94ab5cf2ce |
.data |
3584 |
2.251912 |
| 809c1804672ec420bb9f366f30b025fb |
.pdata |
20480 |
5.768325 |
| 7eb4b39b296be7f4de3339727d0f1eb0 |
.gfids |
512 |
1.995088 |
| 28984c1ba2156023b894e0041ecd2479 |
.rsrc |
512 |
4.724729 |
| 1c7de4ac5824c7b888e15c611cb69191 |
.reloc |
2560 |
5.180527 |
Relationships
| 755bd7a376… |
Downloaded_By |
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f |
| 755bd7a376… |
Downloaded_From |
unioncrypto.vip |
| 755bd7a376… |
Connected_To |
216.189.150.185 |
Description
This file is a 64-bit dynamic-link library (DLL). This file was identified as a payload for the Windows malware. This stage 2 is not immediately downloaded by “UnionCryptoUpdater.exe,” but instead is downloaded after a period of time likely specified by the C2 server at “hxxps[:]//unioncrypto.vip/update.” This delay could be implemented to prevent researchers from immediately obtaining the stage 2 malware.
The C2 and build path are visible from the “NodeDLL.dll” strings. The C2 for the malware is hxxp[:]//216.189.150.185:8080/push.jsp.
The build path found in the strings is “Z:Opalbinx64_ReleaseNodeDll.pdb.” This stage 2 is likely part of a project named “Opal” by the actors, due to the folder in the build path.
NodeDLL.dll has multiple functionalities which can be verified by examining the program imports and strings. Functionalities with corresponding strings/imports include but are not limited to:
1. Get/Update implant configuration
a. Imports: GetComputerNameA, GetCurrentDirectoryW, GetStartupInfoW, GetTimeZoneInformation
b. Strings: CurrentUser
2. Get/Put a file or directory
a. Imports: WriteFile
3. Execute a program
a. Imports: CreateProcessW
4. Directory listing
a. Imports: GetCurrentDirectoryW
5. Active Drive Listing (C:, D:, etc.)
a. Imports: GetLogicalDrives, GetDriveTypeW
6. Move a file/directory
a. Imports: CreateDirectoryW, MoveFileExW
7. Delete a file/directory
a. Imports: DeleteFileW
8. Screenshot active desktop
a. Imports: GetDIBits, CreateCompatibleBitmap, BitBlt, etc from gdi32
9. Execute a shell command through cmd.exe
a. Imports: GetCommandLineW, GetCommandLineA, CreateProcessAsUserW
10. Check IPv4 TCP connectivity against specified target
a. Imports: connect, bind, send, socket, getaddrinfo, etc. from ws2_32
b. Strings: Network unreachable, HTTP/1.%d %d, httponly, Remote file not found
11. Update configuration (beacon interval, AP address, etc.)
a. Strings: Host: %s%s%s:%d, Set-Cookie:
The “NodeDLL.dll” strings also show a hard-coded user agent string: “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134”. Finally, a format string which matches the HostUS C2 is found in the strings: “%s://%s%s%s:%d%s%s%s,” along with many references to proxies or proxy configurations.
216.189.150.185
Tags
command-and-control
URLs
- 216.189.150.185:8080/push.jsp
Ports
Whois
Queried whois.arin.net with “n 216.189.150.185″…
NetRange: 216.189.144.0 – 216.189.159.255
CIDR: 216.189.144.0/20
NetName: HOSTUS-IPV4-3
NetHandle: NET-216-189-144-0-1
Parent: NET216 (NET-216-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS7489, AS25926
Organization: HostUS (HOSTU-4)
RegDate: 2014-08-29
Updated: 2015-12-29
Comment: Please send all abuse reports to abuse@hostus.us
Ref: https://rdap.arin.net/registry/ip/216.189.144.0
OrgName: HostUS
OrgId: HOSTU-4
Address: 125 N Myers St
City: Charlotte
StateProv: NC
PostalCode: 28202
Country: US
RegDate: 2013-07-26
Updated: 2019-10-23
Comment: IP addresses from this network are further reallocated or assigned to customers.
Comment: Please send all abuse reports to abuse@hostus.us.
Comment: Abuse reports must be submitted through email with the IP address in title.
Ref: https://rdap.arin.net/registry/entity/HOSTU-4
OrgNOCHandle: HOSTU2-ARIN
OrgNOCName: HostUS Tech
OrgNOCPhone: +1-302-300-1737
OrgNOCEmail: noc@hostus.us
OrgNOCRef: https://rdap.arin.net/registry/entity/HOSTU2-ARIN
OrgAbuseHandle: HAD18-ARIN
OrgAbuseName: HostUS Abuse Desk
OrgAbusePhone: +1-302-300-1737
OrgAbuseEmail: abuse@hostus.us
OrgAbuseRef: https://rdap.arin.net/registry/entity/HAD18-ARIN
OrgTechHandle: HOSTU2-ARIN
OrgTechName: HostUS Tech
OrgTechPhone: +1-302-300-1737
OrgTechEmail: noc@hostus.us
OrgTechRef: https://rdap.arin.net/registry/entity/HOSTU2-ARIN
Relationships
| 216.189.150.185 |
Connected_From |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
Description
The C2 identified for NodeDLL.dll. The IP address 216.189.150.185 has ASN 7489 and is owned by HostUS.
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390
Tags
backdoordownloaderloadertrojan
Details
| Name |
UnionCryptoTrader.dmg |
| Size |
20911661 bytes |
| Type |
zlib compressed data |
| MD5 |
6588d262529dc372c400bef8478c2eec |
| SHA1 |
06d9f835efd1c05323f6a3abdf66e6be334e47c4 |
| SHA256 |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
| SHA512 |
4a90cd71e210662c3e21994a6af6d80f45c394b972d85ba725dc0e33721036c38b68829ca831113276cbea891fc075e1fa9911aad1fc647b0c2a2bb7a9d965cd |
| ssdeep |
393216:psbbiMqkRiP3p+/34QRDCLqKbNH40iBNTnz0xcECffBJrd8ur8dx3PAxC9lG:WbipIM3p+/TBvBN0xcRmur8dxIxC9l |
| Entropy |
7.997189 |
Antivirus
| Ahnlab |
Backdoor/OSX.Nukesped.20911661 |
| Antiy |
Trojan/Mac.NukeSped |
| Avira |
OSX/Dldr.NukeSped.rtyrb |
| BitDefender |
Trojan.MAC.Lazarus.F |
| Cyren |
Trojan.PXZN-6 |
| ESET |
OSX/TrojanDownloader.NukeSped.B trojan |
| Emsisoft |
Trojan.MAC.Lazarus.F (B) |
| Ikarus |
Trojan-Downloader.OSX.Nukesped |
| K7 |
Trojan ( 0001140e1 ) |
| Lavasoft |
Trojan.MAC.Lazarus.F |
| McAfee |
OSX/Nukesped.b |
| Microsoft Security Essentials |
Trojan:MacOS/NukeSped.C!MTB |
| Sophos |
OSX/NukeSped-AB |
| Symantec |
OSX.Trojan.Gen |
| TrendMicro |
Trojan.3657DE58 |
| TrendMicro House Call |
Trojan.3657DE58 |
| Zillya! |
Downloader.Agent.OSX.68 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| 2ab58b7ce5… |
Downloaded_From |
unioncrypto.vip |
| 2ab58b7ce5… |
Contains |
6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 |
| 2ab58b7ce5… |
Contains |
631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 |
Description
This OSX program from the “UnionCrypto” download link is an Apple DMG installer.
The OSX program does not have a digital signature, and will warn the user of that before installation. Just as previous versions, the UnionCrypto installer appears to be legitimate and installs both “UnionCryptoTrader” (6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0) in the “/Applications/UnionCryptoTrader.app/Contents/MacOS/” folder and a hidden program named “.unioncryptoupdater” (631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680) in the “/Applications/UnionCryptoTrader.app/Contents/Resources/” folder. The installer contains a postinstall script (see figure 10).
This postinstall script is identical in functionality to the postinstall script for the second version. It moves the hidden plist file (.vip.unioncrypto.plist) to the LaunchDaemons folder and changes the file permissions for the plist to be owned by root. Once in the LaunchDaemons folder, this program will be ran on system load as root for every user. This will launch the unioncryptoupdater program.
The postinstall script also moves the hidden “.unioncryptoupdater” binary to a new location “/Library/UnionCrypto/unioncryptoupdater” and makes the file executable. As the LaunchDaemon will not be run immediately after the plist file is moved, the postinstall script then launches the unioncryptoupdater program in the background (&). In contrast to the CelasTradePro “Updater” binary and JMTTrader “CrashReporter” binary, the unioncryptoupdater binary is not launched with any parameters.
Screenshots
Figure 10 – Screenshot of the postinstall script included in UnionCryptoTrader installer.
Figure 11 – Screenshot of the “vip.unioncrypto.plist” file.
6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0
Tags
trojan
Details
| Name |
UnionCryptoTrader |
| Size |
1602900 bytes |
| Type |
Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> |
| MD5 |
41587b0dd5104a4ee6484ff8cf47fd21 |
| SHA1 |
bd41cb308913c4964aef47edafd36faa1f673717 |
| SHA256 |
6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 |
| SHA512 |
efaf37208ee17967df8c435e592b2029d8e56aabd92ca989704bf7908399bf9e84b6312b928fb89907d72518ef40ae95ac6feeb1a19044231bbc60fa14cf18ec |
| ssdeep |
49152:2ScN8VPSplcFjsmEWe7JEANYIwErVqpxPM0:M40ltBWeFuHbE0 |
| Entropy |
6.459336 |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| 6f45a004ad… |
Contained_Within |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
Description
This OSX sample was contained within Apple DMG Installer “UnionCryptoTrader.dmg.” When executed, UnionCryptoTrader loads a legitimate cryptocurrency arbitrage application with no signs of malicious activity. (Note: arbitrage is defined as “the simultaneous buying and selling of securities, currency, or commodities in different markets or in derivative forms in order to take advantage of differing prices for the same asset”). This application does not appear to be a modification of the OSX QT Bitcoin Trader, but may be a modification of Blackbird Bitcoin Arbitrage11.
In addition to the “unioncrypto.vip” site describing UnionCryptoTrader as a “Smart Cryptocurrency Arbitrage Trading Platform,” may of the strings found in UnionCryptoTrader have references to Blackbird Bitcoin Arbitrage including but not limited to:
–Begin similarities–
Blackbird Bitcoin Arbitrage
| Blackbird Bitcoin Arbitrage Log File |
output/blackbird_result_
output/blackbird_log_
ERROR: Blackbird needs at least two Bitcoin exchanges. Please edit the config.json file to add new exchanges
–End similarities–
The strings also contain the links and references to all fourteen exchanges listed as implemented or potential on the Blackbird GitHub page.
631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680
Tags
backdoordownloaderloadertrojan
Details
| Name |
unioncryptoupdater |
| Size |
79760 bytes |
| Type |
Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> |
| MD5 |
da17802bc8d3eca26b7752e93f33034b |
| SHA1 |
e8f29f1e3f35a4f2c18be424551e280ed66b1dd7 |
| SHA256 |
631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 |
| SHA512 |
a32672fa780675e767e37fa1b8d186951cb934279cb416766c518a7d6f76b6521176a5055045c0af7ec1ce5f9882a952ed8761b54f9cb12587b831d9c26ea529 |
| ssdeep |
1536:4YGnCXIbO9KBQJELi6VA2l5+r1M6JBM4YQNVZ3MpJy5TU23MpJy5Tp:3eCYK5JEBXaM6Jq4p3MpJy5Tb3MpJy5T |
| Entropy |
4.871481 |
Antivirus
| Ahnlab |
Backdoor/OSX.Nukesped.79760 |
| Antiy |
Trojan/Mac.NukeSped |
| Avira |
OSX/Agent.hwuxh |
| BitDefender |
Trojan.MAC.Lazarus.D |
| ClamAV |
Osx.Malware.Agent-7430998-0 |
| ESET |
OSX/TrojanDownloader.NukeSped.B trojan |
| Emsisoft |
Trojan.MAC.Lazarus.D (B) |
| Ikarus |
Trojan-Downloader.OSX.Nukesped |
| K7 |
Trojan ( 0001140e1 ) |
| Lavasoft |
Trojan.MAC.Lazarus.D |
| McAfee |
OSX/Lazarus.b |
| Microsoft Security Essentials |
Trojan:MacOS/NukeSped.C!MTB |
| NANOAV |
Trojan.Mac.Download.gknigf |
| Quick Heal |
MacOS.Trojan.39995.GC |
| Sophos |
OSX/Lazarus-F |
| Symantec |
OSX.Trojan.Gen |
| TrendMicro |
TROJ_FR.ED65B0ED |
| TrendMicro House Call |
TROJ_FR.ED65B0ED |
| Zillya! |
Downloader.NukeSped.OSX.6 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| 631ac26992… |
Contained_Within |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
Description
This OSX sample was contained within Apple DMG Installer “UnionCryptoTrader.dmg.” This malware is signed adhoc, meaning it is not signed with a valid code signing ID.
When executed, unioncryptoupdater immediately calls the “onRun()” function, which contains most of the logic and functionality for this malware. This function first collects different information about the system the malware is running on. It uses IOKit, which is an Apple framework designed to allow programs to gain user-access to hardware devices and drivers. IOKit is specifically used to retrieve the system serial number with IOPlatformSerialNumber global variable (Figure 12).
The function then collects the operating system version by reading the system file at “/System/Library/CoreServices/SystemVersion.plist,” and specifically extracting the ProductVersion and ProductBuildVersion from the system file (Figure 13).
After collecting the system data, unioncryptoupdater then builds a string consisting of the current time and the hard-coded value “12GWAPCT1F0I1S14″ (Figure 14).
This string is MD5 hashed and stored in the “auth_signature” variable and the current time (used to create string for “auth_signature”) in the “auth_timestamp” variable. These variables are sent in the first communication to the C2 server and are likely used to verify any connections to the server are actually originating from the unioncryptoupdater malware.
All collected data and the “auth_signature” and “auth_timestamp” are sent to hxxps[:]//unioncrypto.vip/update using the Barbeque::post() method. The Barbeque class is custom made C++ class which has both a post() and a get() method, which utilize libcurl to perform network communications for the malware. Barbeque::post() sends the system data in this specific format:
–Begin format–
rlz=[device serial number]&ei=[ProductVersion] (ProductBuildVersion)&act=check
–End format–
These values are found as described above or are hard-coded into the malware data section (Figure 15).
If the C2 server returns the string “0,” unioncryptotrader will sleep for ten minutes and then regenerate the auth_timestamp and auth_signature to contact the C2 again via the same Barbeque::post() method.
If the C2 server does not return the string “0,” the malware will decode the base64 payload, and decrypt it using the C++ aes_decrypt_cbc function. After decryption, the malware uses the OSX function mmap to allocate memory with read, write, and execute permissions. This is specified by the 7 loaded into the edx register before mmap is called. (Note: the 7, or binary 111, comes from OR’ing the read (100), write (010), and execute (001) binary values together, just as file permissions are often set). If mmap is successful in allocating the memory, the function then uses memcpy to copy the decrypted payload into the mmap’d memory region (Figure 16).
After the decrypted payload is copied into memory, unioncryptoupdater calls a function named memory_exec2, which utilizes Apple API NSCreateObjectFileImageFromMemory to create an “object file image” from the memory, and Apple API NSLinkModule to link the “object file image”. The API calls are necessary to allow the payload in memory to execute, as files in memory are not simply able to execute as files on disk are (Figure 17).
Once the malware has mapped and linked the payload in memory, it searches the mapped memory for “0xfeedfacf,” which is the magic number for 64-bit OSX executables. This check is likely included to verify the payload was properly decoded, decrypted, and memory mapped before attempting execution (Figure 18).
After verifying the magic number, the malware searches for the address 0x80000028, which is the address of the LC_MAIN Load Command. Load Commands are similar to a table of contents for an OSX executable which contain commands and command positions in the binary. Offset 0x8 of the LC_MAIN load command contains the offset of the OSX executable entry point (Figure 19). This entry point is placed in register r8, and is called by the malware.
This process of allocating memory, copying the payload into memory, and calling the entry point achieves pure in-memory execution of the remotely downloaded payload. As such, if this is successful, the payload can be executed exclusively in memory and is never copied to disk.
If any part of the memory code execution process fails, unioncryptoupdater will write the received payload to “/tmp/updater” instead and execute it with a call to system (Figure 20).
The payload for this OSX malware could not be downloaded, as the C2 server “unioncrypto.vip/update” is no longer accessible. In addition, the payload was not identified in open source reporting.
Screenshots
Figure 12 – Screenshot of the IOPlatformSerialNumber reference in unioncryptoupdater.
Figure 13 – Screenshot of the unioncryptoupdater collecting OS version.
Figure 14 – Screenshot of unioncryptoupdater getting current time and combining with hard-coded value.
Figure 15 – Screenshot of the various hard-coded values in unioncryptoupdater.
Figure 16 – Screenshot of mmap and memcpy in unioncryptoupdater.
Figure 17 – Screenshot of NSCreateObjectFileImageFromMemory.
Figure 18 – Screenshot of 39FEEDFACF in unioncryptoupdater.
Figure 19 – Screenshot of the load and call entry point of payload.
Figure 20 – Screenshot of the write payload to disk and execute.
Relationship Summary
| e3623c2440… |
Contains |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
| unioncrypto.vip |
Downloaded_To |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
| unioncrypto.vip |
Downloaded_To |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
| af4144c1f0… |
Contained_Within |
e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 |
| af4144c1f0… |
Contains |
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f |
| af4144c1f0… |
Contains |
0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 |
| 0967d2f122… |
Contained_Within |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
| 01c13f825e… |
Downloaded |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
| 01c13f825e… |
Contained_Within |
af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 |
| 755bd7a376… |
Downloaded_By |
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f |
| 755bd7a376… |
Downloaded_From |
unioncrypto.vip |
| 755bd7a376… |
Connected_To |
216.189.150.185 |
| 216.189.150.185 |
Connected_From |
755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 |
| 2ab58b7ce5… |
Downloaded_From |
unioncrypto.vip |
| 2ab58b7ce5… |
Contains |
6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 |
| 2ab58b7ce5… |
Contains |
631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 |
| 6f45a004ad… |
Contained_Within |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
| 631ac26992… |
Contained_Within |
2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 |
Recommendations
CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization’s systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.
- Maintain up-to-date antivirus signatures and engines.
- Keep operating system patches up-to-date.
- Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
- Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
- Enforce a strong password policy and implement regular password changes.
- Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
- Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
- Disable unnecessary services on agency workstations and servers.
- Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
- Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
- Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
- Scan all software downloaded from the Internet prior to executing.
- Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).
Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, “Guide to Malware Incident Prevention & Handling for Desktops and Laptops”.
Contact Information
CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/
Document FAQ
What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.
What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.
Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Service Desk.
Can I submit malware to CISA? Malware samples can be submitted via three methods:
CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA’s homepage at www.cisa.gov.
![MAR-10322463-3.v1 – AppleJeus: Union Crypto]()
by Scott Muniz | Feb 17, 2021 | Security, Technology
This article is contributed. See the original author and article here.
Malware Analysis Report
10322463.r1.v1
2021-02-12
Notification
This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.
This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.
Summary
Description
This Malware Analysis Report (MAR) is the result of analytic efforts among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) to highlight the cyber threat to cryptocurrency posed by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK), and provide mitigation recommendations. Working with U.S. government partners, FBI, CISA, and Treasury assess that Lazarus Group—which these agencies attribute to North Korean state-sponsored advanced persistent threat (APT) actors—is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.
This MAR highlights this cyber threat posed by North Korea and provides detailed indicators of compromise (IOCs) used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on other versions of AppleJeus and recommended steps to mitigate this threat, see Joint Cybersecurity Advisory AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware at https://www.us-cert.cisa.gov/ncas/alerts/AA21-048A.
There have been multiple versions of AppleJeus malware discovered since its initial discovery in August 2018. In most versions, the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.
The U.S. Government has identified AppleJeus malware version—Celas Trade Pro—and associated IOCs used by the North Korean government in AppleJeus operations.
In August 2018, open source reporting revealed information about a Trojanized version of a legitimate cryptocurrency trading application on a victim’s computer (Note: identity of the victim was not disclosed). The malicious program, known as Celas Trade Pro, is a modified version of the benign QT Bitcoin Trader application. This incident led to the victim company being infected with the malware known to the U.S. Government as FALLCHILL, a North Korean remote administration tool (RAT). According to CISA, FALLCHILL “is a fully functional RAT with multiple commands that the actors can issue from a command and control (C2) server to a victim’s system via dual proxies. FALLCHILL typically infects a system as a file dropped by other HIDDENCOBRA malware. Because of this, additional HIDDENCOBRA malware may be present on systems compromised with FALLCHILL.”
Celas Trade Pro had been recommended to the victim company via a phishing email from a company known as Celas Limited. The email provided a link to the Celas Limited website (https://www[.]celasllc.com), where the user could download a Windows or MacOS version of the Celas Trade Pro software.
For a downloadable copy of IOCs, see: MAR-10322463-1.v1.stix.
Submitted Files (6)
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 (Updater)
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 (celastradepro_win_installer_1….)
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 (CelasTradePro.exe)
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb (Updater.exe)
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 (CelasTradePro)
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 (celastradepro_mac_installer_1….)
Domains (1)
celasllc.com
Findings
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
Tags
droppertrojan
Details
| Name |
celastradepro_win_installer_1.00.00.msi |
| Size |
9827840 bytes |
| Type |
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {A3B40756-2C9C-4167-9296-5DD2DAF7973E}, Number of Words: 2, Subject: CelasTradePro, Author: CELAS LLC, Name of Creating Application: Advanced Installer 14.5.2 build 83143, Template: ;1033, Comments: This installer database contains the logic and data required to install CelasTradePro., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 |
| MD5 |
9e740241ca2acdc79f30ad2c3f50990a |
| SHA1 |
0c5e4cec03d2eea2b1dd5356fe05de64a0278cd6 |
| SHA256 |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
| SHA512 |
dd02c1e717c2556b64d261f04c5a8add7dcc2f3ad267507d883ba68c7e4cf827136edce517aab055dfa02d8569a5779eb1fc24fb0b7c6bb3447d45e2802726e5 |
| ssdeep |
196608:s80YaAWH7ICcfRLdq81w920W+ZP6g2DsjW1TIZfxgNu1DZNJQfIYizTrh50:sPUWHECcfBdR1w9NWqSg2DsK1TmfxgiD |
| Entropy |
7.973409 |
Antivirus
| Ahnlab |
MSI/Installer |
| Comodo |
Malware |
| Microsoft Security Essentials |
Trojan:Win32/Letdater |
| Quick Heal |
OLE.MSI.Agent.39994.GC |
| Sophos |
Troj/NukeSped-X |
| Symantec |
Trojan.Dropper |
| TrendMicro |
Trojan.BC27BA50 |
| TrendMicro House Call |
Trojan.BC27BA50 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| 6ee19085ad… |
Downloaded_From |
celasllc.com |
| 6ee19085ad… |
Contains |
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 |
| 6ee19085ad… |
Contains |
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb |
Description
This Windows program from the Celas LLC site is a Windows MSI Installer. The installer looks legitimate and previously had a valid digital signature from Comodo (Sectigo). The signature was signed with a code signing certificate purchased by the same user as the Secure Sockets Layer (SSL) certificate for “celasllc.com.” The installer asks for administrative privileges to run and while installing “CelasTradePro.exe” (a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765) it also installs “Updater.exe” in the “C:Program Files (x86)CelasTradePro” folder. Immediately after installation, the installer launches “Updater.exe” (bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb) with the “CheckUpdate” parameter.
Screenshots
Figure 1 – Screenshot of the CelasTradePro installation.
celasllc.com
Tags
command-and-control
URLs
- celasllc.com/checkupdate.php
Whois
Whois for celasllc.com had the following information in August 2018:
IP Address: 185.142.236.213
Registrant Name: John Broox
Registrant Organization:
Registrant Street: 2141 S Archer Ave
Registrant City: Chicago
Registrant State/Province: Illinois
Registrant Postal Code: 60601
Registrant Country: US
Registrant Phone: +1.8133205751
Registrant Email: johnbroox200@gmail.com
Name server: 1a7ea920.bitcoin-dns.hosting
Name Server: a8332f3a.bitcoin-dns.hosting
Name Server: ad636824.bitcoin-dns.hosting
Name Server: c358ea2d.bitcoin-dns.hosting
Created: May 29, 2018
Expires: May 29, 2019
Updated: Sep 9, 2018
Relationships
| celasllc.com |
Downloaded_To |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
| celasllc.com |
Downloaded_To |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
Description
The Celas Limited website had a professional appearance, and at the time had a valid Secure Sockets Layer (SSL) certificate issued by Comodo (now Sectigo). The SSL certificate was “Domain Control Validated,” which is a weak security verification level for a webserver. Typically, this is a fully automated verification where the certificate requester only needs to demonstrate control over the domain name (i.e. with an email like admin[@]celasllc.com). This type of certificate necessitates no validation of the identity of the website’s owner, nor the existence of the actual business. At the time of analysis, the domain celasllc.com resolved to IP address 185.142.236.213, which belongs to the Netherlands Amsterdam Blackhost Ltd ISP, AS174, Cogent Communications.
Screenshots
Figure 2 – Screenshot of the Celas LLC website.
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765
Tags
trojan
Details
| Name |
CelasTradePro.exe |
| Size |
2517160 bytes |
| Type |
PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 |
45eb8f06c5f732e8dde8e9318d8b2392 |
| SHA1 |
d4583cba9034a3068f8106b5013d37d7bdd46f38 |
| SHA256 |
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 |
| SHA512 |
6536a7b0767828bb95f6f33a4e465fec48fc474b4f919bc878e02966f82f900fbaa6e2f9d7bc1dffa28bbe35f94ee6b9a570902843dfd35a8c9d1405ac130039 |
| ssdeep |
49152:TrxfUhMyK0lq3Z8SC8Q1ZZmpwi0qEdz+7WGSVOr:PxfU60lqiV1UL |
| Entropy |
6.852284 |
Antivirus
YARA Rules
No matches found.
ssdeep Matches
No matches found.
PE Metadata
| Compile Date |
2018-06-17 20:17:48-04:00 |
| Import Hash |
33ef6aff05b44076249d6ed27e247e11 |
| Company Name |
Celas LLC |
| File Description |
Celas Bitcoin Trader |
| Internal Name |
Celas Bitcoin Trader |
| Legal Copyright |
Copyright (C) 2018 CELAS LLC |
| Original Filename |
CelasTradePro.exe |
| Product Name |
CelasTradePro |
| Product Version |
1.0.0.0 |
PE Sections
| MD5 |
Name |
Raw Size |
Entropy |
| 724cd82da1ca0a93b9d171923d149ce9 |
header |
1024 |
2.738571 |
| 4909abcdca48f01dd7d44d7b6035deef |
.text |
1152000 |
6.244241 |
| 88f7c98251537ffd1f94935b8c134b9a |
.rdata |
1076224 |
6.842683 |
| 0e102f466e9e6893970e2fd96c8b3fce |
.data |
9728 |
4.517533 |
| 87a4b3b57b1b37d19870a4f1c9577374 |
.rsrc |
110592 |
3.737298 |
| a6d8c9855dc4334bb35c95a1e0518a9d |
.reloc |
162304 |
6.385957 |
Packers/Compilers/Cryptors
Relationships
| a84ed8ce71… |
Contained_Within |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
Description
This file is a 32-bit Windows executable contained within the Windows MSI Installer “celastradepro_win_installer_1.00.00.msi.” When executed, “CelasTradePro.exe” asks for the user’s exchange and then loads a legitimate cryptocurrency trading platform with no signs of malicious activity.
CelasTradePro is extremely similar in appearance to a version of an open source cryptocurrency trading platform available around the same timeframe known as QT Bitcoin Trader (screenshots 3 and 4). In addition to similar appearance, many strings found in CelasTradePro have QT Bitcoin Trader references and parameters being set to “Celas Trade Pro” including but not limited to:
–Begin similarities–
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro
QtBitcoinTrader
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro is a free Open Source project developed on pure C++ Qt and OpenSSL.
julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader)
–End similarities–
The strings also reference the name “John Broox” as the author of CelasTradePro.
While the CelasTradePro application is likely a modification of QT Bitcoin Trader, the legitimate QT Bitcoin Trader for Windows is not available for download as an MSI, but only as a Windows portable executable. This is a singular file named “QtBitcoinTrader.exe” and does not install or run any additional programs. The CelasTradePro MSI contains “CelasTradePro.exe,” the modified version of QT Bitcoin Trader, as well as the additional “Updater.exe” (bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb) executable not included with the original QT Bitcoin Trader.
Screenshots
Figure 3 – Screenshot of the CelasTradePro application.
Figure 4 – Screenshot of the QT Bitcoin Trader application.
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb
Tags
downloaderloaderspywaretrojan
Details
| Name |
Updater.exe |
| Size |
173224 bytes |
| Type |
PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5 |
b054a7382adf6b774b15f52d971f3799 |
| SHA1 |
b4d43cd2d81d17dec523915c0fc61b4b29e62c58 |
| SHA256 |
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb |
| SHA512 |
7c307a2ed0e6e483a0f3e7161ff0433e6bd498ab0b14b5359a938554999b076c4143a766b96c05dc0b949948cac97d81534ceb1300d02276ec90e2c1162383a9 |
| ssdeep |
1536:XN9cIi98pUYi7tIP+arPg1ssvpoOJwtFT6BxdYIHs/5mBS0LiF:99clzLPPBoOJwWBxdYlxySr |
| Entropy |
4.980364 |
Antivirus
| Ahnlab |
Malware/Win32.Generic |
| Antiy |
Trojan[Downloader]/Win32.Agent |
| Avira |
TR/Dldr.Agent.jlhae |
| BitDefender |
Trojan.GenericKD.40404380 |
| ClamAV |
Win.Spyware.Fallchill-6663754-2 |
| Comodo |
Malware |
| ESET |
Win32/TrojanDownloader.NukeSped.E trojan |
| Emsisoft |
Trojan.GenericKD.40404380 (B) |
| Ikarus |
Trojan-Downloader.Agent |
| K7 |
Riskware ( 0040eff71 ) |
| Lavasoft |
Trojan.GenericKD.40404380 |
| McAfee |
Generic trojan.d |
| Microsoft Security Essentials |
Trojan:Win32/Letdater |
| NANOAV |
Trojan.Win32.Letscool.fflqoo |
| Sophos |
Troj/NukeSped-Y |
| Symantec |
Trojan Horse |
| Systweak |
trojan.agent |
| TrendMicro |
Trojan.BC27BA50 |
| TrendMicro House Call |
Trojan.BC27BA50 |
| VirusBlokAda |
TrojanDownloader.Agent |
| Zillya! |
Downloader.Agent.Win32.365188 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
PE Metadata
| Compile Date |
2018-06-15 06:56:27-04:00 |
| Import Hash |
b25cd98650edb58a9a4d00af1d17453d |
PE Sections
| MD5 |
Name |
Raw Size |
Entropy |
| 2c879beba343ce37c06647fb37be983e |
header |
1024 |
2.572659 |
| 4da943f482631027a2152c6f336055af |
.text |
38912 |
6.556738 |
| 0b7c67c806051953aa6addc2771a20eb |
.rdata |
10240 |
4.875590 |
| 49f73fd786fe23fbc68635fbf76b63a3 |
.data |
4096 |
2.272665 |
| 7a96caced6b43d719b90f6e332ad12f3 |
.rsrc |
109568 |
3.715817 |
| 8aacf0cff202d7d74c04f938df61e45f |
.reloc |
4096 |
4.127553 |
Packers/Compilers/Cryptors
Relationships
| bdff852398… |
Contained_Within |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
Description
This file is a 32-bit Windows executable contained within the Windows MSI Installer “celastradepro_win_installer_1.00.00.msi.” “Updater.exe” has the same program icon as CelasTradePro. Updater.exe was likely developed under the name “jeus” based on the build path “Z:jeusdownloaderdownloader_exe_vs2010Releasedloader.pdb” found in the code (partial origin of the name AppleJeus).
“Updater.exe” collects victim host information and sends it back to the server. At launch the malware first checks for the “CheckUpdate” parameter and if not found, exits the program. This is likely to evade detection in a sandbox environment. If the “CheckUpdate” parameter is found, the malware creates a unique identifier for the system following the format “%09d-%05d.” It then collects process lists excluding the “System” processes and queries the registry at “HKLMSOFTWAREMicrosoftWindow NTCurrentVersion” for the following values:
–Begin values–
ProductName (Windows OS Version)
CurrentBuildNumber (Windows 10 build version)
ReleaseID (Windows 10 version information)
UBR (Sub version of Windows 10 build)
BuildBranch (Windows 10 build branch information)
–End values–
After collecting this information, “Updater.exe” encrypts the data with the hard-coded XOR key “Moz&Wie;#t/6T!2y,” prepends the encrypted data with “GIF89a” (image header) and sends the data to “celasllc.com/checkupdate.php.”
The malware also uses a hard-coded User-Agent string “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0” and multipart form data separator “jeus.” If the malware receives a response with HTTP code 200, it will decode the base64 payload, then decrypt the result using the hard-coded RC4 decryption key “W29ab@ad%Df324V$Yd.” The raw data is then written to a file prepended with the “MAX_PATHjeusD” string.
Screenshots
Figure 5 – Screenshot of the “CheckUpdate” parameter verification in “Updater.exe.”
Figure 6 – Hard-coded XOR key and XOR encryption in “Updater.exe.”
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
Tags
downloaderdropperloadertrojan
Details
| Name |
celastradepro_mac_installer_1.00.00.dmg |
| Size |
15020544 bytes |
| Type |
DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 1, 29336 sectors, extended partition table (last) |
| MD5 |
48ded52752de9f9b73c6bf9ae81cb429 |
| SHA1 |
1e8a2f1f751e5a9931bca5710b4f304798d665dc |
| SHA256 |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
| SHA512 |
4c4e4445638ace360c82be741e634601bd1beaf980cdc02523484cc7f161b57015f325708ce72d9a2496f3b5bf2d05df5133aee0d1c375b76b23e6a660436d0f |
| ssdeep |
393216:0naJ/9SL/uXRs1q5wxrCAveZZXFdklxkBSY6bzLZaM:bJ/9SLQRwqSrCAS5klxPY6bXZx |
| Entropy |
7.710370 |
Antivirus
| Antiy |
Trojan/OSX.Lazarus |
| Avira |
OSX/Lazarus.A |
| Comodo |
Malware |
| ESET |
OSX/TrojanDownloader.NukeSped.A trojan |
| Ikarus |
Trojan.OSX.Lazarus |
| McAfee |
OSX/Lazarus.a |
| Symantec |
OSX.Dropper |
| TrendMicro |
OSX_APPLEJEUS.A |
| TrendMicro House Call |
OSX_APPLEJEUS.A |
| Vir.IT eXplorer |
OSX.Lazarus.ASM |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| d404c0a634… |
Downloaded_From |
celasllc.com |
| d404c0a634… |
Contains |
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 |
| d404c0a634… |
Contains |
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 |
Description
This OSX program from the Celas LLC site is an Apple DMG Installer. The OSX program has very similar functionality to the Windows program and also previously had a valid digital signature from Comodo. Again the installer appears to be legitimate, and installs CelasTradePro as well as a program named “Updater” in the “/Applications/CelasTradePro.app/Contents/MacOS/” folder. The installer contains a postinstall script (see figure 6).
A postinstall script is a sequence of instructions which runs after the successful installation of an OSX application. This script moves the hidden “.com.celastradepro.plist” file from the installer package to the LaunchDaemons folder. This file is hidden because the leading “.” causes it to not be shown to the user if they view the folder in the Finder application. Once in the LaunchDaemons folder, this plist file will be ran on system load as root for every user. This will launch the Updater program with the CheckUpdate parameter.
As the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script then launches the Updater program with the CheckUpdate parameter and runs it in the background (&). The package also has “Developed by John Broox. CELAS LLC” in the Info.plist properties file.
Screenshots
Figure 7 – Screenshot of the postinstall script included in OSX Celas installer.
Figure 8 – Screenshot of the “com.celastradepro.plist” file.
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70
Tags
trojan
Details
| Name |
CelasTradePro |
| Size |
3544560 bytes |
| Type |
Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> |
| MD5 |
4eedb2df53597a15fd48b726d85517f0 |
| SHA1 |
a60ece7673fa415abe1fb97ac60e19ee446858b1 |
| SHA256 |
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 |
| SHA512 |
853c85760576919bc59aee901663057a0bfd5a286345cc7464f61e7bdfdebfeb2148401597ae037bbf052c052112cb37c34924b2876383c920d17b908f0e3a85 |
| ssdeep |
49152:bvzxIgxauUDh0Dh6jQIRfzOQo14GNoiZPw6YBoOBzRK8IA1LGqBKta9w35wwlRoJ:3xuwhRIR2LPZPwX1vbL9BgwseMzio |
| Entropy |
6.559908 |
Antivirus
| Ahnlab |
OSX/Agent.3544560 |
| Antiy |
Trojan/OSX.Lazarus |
| Avira |
OSX/Lazarus.dplva |
| BitDefender |
Trojan.MAC.Lazarus.B |
| ClamAV |
Osx.Malware.Agent-7408161-0 |
| ESET |
a variant of Generik.IWGLIQC trojan |
| Emsisoft |
Trojan.MAC.Lazarus.B (B) |
| Ikarus |
OSX.Lazarus |
| Lavasoft |
Trojan.MAC.Lazarus.B |
| McAfee |
OSX/Lazarus.f |
| Sophos |
OSX/Lazarus-D |
| Symantec |
OSX.Malcol.2 |
| Zillya! |
Trojan.MAC.OSX.89 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| c0c2239138… |
Contained_Within |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
Description
This OSX sample was contained within Apple DMG Installer “celastradepro_mac_installer_1.00.00.dmg.” When executed, CelasTradePro has identical functionality and appearance to the Windows version CelasTradePro.exe. It asks for the users’ exchange and loads a legitimate cryptocurrency trading application with no signs of malicious activity. As functionality and appearance are the same, it follows that CelasTradePro is a modification of the OSX QT Bitcoin Trader. In addition to similar appearance, many strings found in CelasTradePro have QT Bitcoin Trader references and parameters being set to “Celas Trade Pro” including but not limited to:
–Begin similarities–
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro is a free Open Source project<br>developed on pure C++ Qt and OpenSSL.
String_APPLICATION_TITLE=Qt Bitcoin Trader
julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader)
–End similarities–
The strings also reference the name “John Broox” as the author of CelasTradePro.
While the CelasTradePro application is likely a modification of QT Bitcoin Trader, the legitimate QT Bitcoin Trader DMG for OSX does not contain the postinstall script nor the plist file which creates a LaunchDaemon. When ran, only QTBitcoinTrader will be installed, and no additional programs will be created, installed, or launched.
The CelasTradePro DMG contains the CelasTradePro OSX executable (the modified version of QT Bitcoin Trader) as well as the additional Updater OSX executable not included with the original QT Bitcoin Trader.
Screenshots
Figure 9 – Screenshot of the legitimate QTBitcoinTrader DMG contents.
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0
Tags
backdoordownloaderloadertrojan
Details
| Name |
Updater |
| Size |
50320 bytes |
| Type |
Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE> |
| MD5 |
aeee54a81032a6321a39566f96c822f5 |
| SHA1 |
53aa0971eb5d53ed242764ebfc89ad591a5211b2 |
| SHA256 |
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 |
| SHA512 |
9e9abc2c824df20249df9161ad830af2a3d01867089eed23d5985445e34120238881ac3cfd9529bf27588c36f2a17533a4bda8fce8c91949360c236b60852fb0 |
| ssdeep |
768:A4yOeE/pwi8Aea02PG2mG1oAK+g7mj78yfgum0+mifm:GOeE/pwFs02pvg7mj7bfgum0hi |
| Entropy |
5.010104 |
Antivirus
| Ahnlab |
OSX/Agent.50320 |
| Antiy |
Trojan/OSX.Lazarus |
| Avira |
VBS/Dldr.Formac.npwdq |
| BitDefender |
Trojan.MAC.Lazarus |
| ClamAV |
Osx.Malware.Agent-9667647-0 |
| Comodo |
Malware |
| ESET |
a variant of OSX/TrojanDownloader.NukeSped.A trojan |
| Emsisoft |
Trojan.MAC.Lazarus (B) |
| Ikarus |
Trojan.MAC.Lazarus |
| Lavasoft |
Trojan.MAC.Lazarus |
| Microsoft Security Essentials |
Backdoor:MacOS/AppleJeus.A |
| NANOAV |
Trojan.Mac.Mlw.fhnynm |
| Sophos |
OSX/Lazarus-D |
| Symantec |
OSX.Trojan.Gen |
| TrendMicro |
OSX_LAZARUS.A |
| TrendMicro House Call |
OSX_LAZARUS.A |
| Zillya! |
Downloader.NukeSped.OSX.1 |
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| 5e54bccbd4… |
Contained_Within |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
Description
This OSX sample was contained within Apple DMG Installer “celastradepro_mac_installer_1.00.00.dmg.” Updater functions very similarly to the Windows Updater.exe, and collects victim host information to send back to the server. Upon launch, the malware checks for the “CheckUpdate” parameter, and just as the Windows sample, will exit if the parameter is not found. This is likely to avoid sandbox analysis. If the “CheckUpdate” parameter is found, the malware then creates a unique identifier for the system following the format “%09d-%06d.”
Updater then uses dedicated QT classes to get system information including host name, OS type and version, system architecture, and OS kernel type and version. The QT Framework is a cross-platform toolkit designed for creating multi-platform applications with native Graphical User Interfaces (GUI) for each platform.
After collecting this data, Updater follows the same process as the Windows “Updater.exe” to encrypt and send the data. All data is XOR encrypted with the hard-coded key “Moz&Wie;#t/6T!2y”, prepended with “GIF89a” (image header), and sent to www[.]celasllc.com/checkupdate.php. The malware uses the same multipart form data separator “jeus” but has a different hard-coded user-agent string of “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36.”
If Updater receives a response with the HTTP code 200, it will decode the base64 payload, and decrypt it using the same hard-coded RC4 key “W29ab@ad%Df324V$Yd” as the Windows malware. The decrypted data is then saved to the hard-coded “/var/zdiffsec” file location, file permissions are changed to executable for all users, and the file is started with the hard-coded command line argument “bf6a0c760cc642.”
Screenshots
Figure 10 – Screenshot of the “CheckUpdate” parameter verification in “Updater.”
Figure 11 – Screenshot of various hard-coded values in “Updater.”
Relationship Summary
| 6ee19085ad… |
Downloaded_From |
celasllc.com |
| 6ee19085ad… |
Contains |
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 |
| 6ee19085ad… |
Contains |
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb |
| celasllc.com |
Downloaded_To |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
| celasllc.com |
Downloaded_To |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
| a84ed8ce71… |
Contained_Within |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
| bdff852398… |
Contained_Within |
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 |
| d404c0a634… |
Downloaded_From |
celasllc.com |
| d404c0a634… |
Contains |
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 |
| d404c0a634… |
Contains |
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 |
| c0c2239138… |
Contained_Within |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
| 5e54bccbd4… |
Contained_Within |
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 |
Conclusion
After a cyber-security organization published a report detailing the above programs and their malicious extras, the Celas LLC site was no longer accessible. As this site was the command and control server (C2), the payload cannot be confirmed. The cyber security organization who published the AppleJeus report states the payload was an encrypted and obfuscated binary which eventually drops FALLCHILL onto the machine and installs it as a service.
The FALLCHILL sample found by the cyber security organization had two default C2 server addresses:
196.38.48.121 – South Africa Internet Solutions, AS3741
185.142.236.226 – Netherlands Amsterdam Blackhost Ltd ISP, AS174 Cogent Communications
The C2 185.142.236.226 resides in the same Autonomous System Number (ASN) and ISP as the celasllc.com domain. Furthermore, these IP addresses have been used in three earlier versions of FALLCHILL for C2 according to open source reporting:
–Begin MD5 and timestamp–
94dfcabd8ba5ca94828cd5a88d6ed488 2016-10-24 02:31:18
14b6d24873f19332701177208f85e776 2017-06-07 06:41:27
abec84286df80704b823e698199d89f7 2017-01-18 04:29:29
–End MD5 and timestamp–
File Properties for this sample of FALLCHILL after decryption:
MD5: d7089e6bc8bd137a7241a7ad297f975d
SHA-1: 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41
SHA-256: 08012e68f4f84bba8b74690c379cb0b1431cdcadc9ed076ff068de289e0f6774
FALLCHILL malware uses a RC4 encryption algorithm with a 16-byte key to protect its communications. According to reporting from the cyber-security organization that published the original AppleJeus report, the key extracted from the FALLCHILL variant used in the Celas Trade Pro application is “DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B.” This RC4 key has also been used in a previous version of FALLCHILL used by DPRK actors, as further documented in the US-CERT Malware Analysis Report AR18-165A released on June 14, 2018. This report was a joint effort by the FBI and DHS, while working with other U.S. Government partners, to analyze and attribute computer intrusion activity from the DPRK.
Note: The version numbers for AppleJeus correspond to the order the campaigns were identified open source or through investigative means. These versions may or may not be in the correct order for development or deployment of the AppleJeus campaigns.
Recommendations
CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization’s systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.
- Maintain up-to-date antivirus signatures and engines.
- Keep operating system patches up-to-date.
- Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
- Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
- Enforce a strong password policy and implement regular password changes.
- Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
- Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
- Disable unnecessary services on agency workstations and servers.
- Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
- Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
- Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
- Scan all software downloaded from the Internet prior to executing.
- Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).
Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, “Guide to Malware Incident Prevention & Handling for Desktops and Laptops”.
Contact Information
CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/
Document FAQ
What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.
What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.
Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Service Desk.
Can I submit malware to CISA? Malware samples can be submitted via three methods:
CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA’s homepage at www.cisa.gov.
Recent Comments