Threat Intelligence Report - August 5-11, 2019

Trends

• The top attacker country was United States with 1692 unique attackers (24%).
• The top Exploit event was Shellcode with 61% of occurrences.
• The top Trojan C&C server detected was Elf with 64 instances detected.

Top Attacker by Country

Threat Geo-location

Top Attacking Hosts

Top Network Attackers

Top Event NIDS and Exploits

Top Alarms

Comparison from last week 

Remote Access Trojan C&C Servers Found

Common Malware

CVE

This is a list of recent vulnerabilities for which exploits are available.

ID:        CVE-2019-1125
Title:    Microsoft Windows Kernel Information Disclosure Vulnerability
Vendor: Microsoft
Description: An information disclosure vulnerability exists when certain central processing units speculatively access memory. An attacker who successfully exploited the vulnerability could read privileged data across trust boundaries. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application. The vulnerability would not allow an attacker to elevate user rights directly, but it could be used to obtain information that could be used to try to compromise the affected system further.
CVSS v2 Base Score:    4.0 

ID:        CVE-2019-11247
Title:    Kubernetes Incomplete Fix Arbitrary File Overwrite Vulnerability
Vendor:    Kubernetes
Description: A vulnerability exists in the K8s API that could allow users to read, modify or delete cluster-wide custom resources, even if they only have RBAC permissions for namespaced resources. This vulnerability allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges).
CVSS v2 Base Score: 5.1 

ID:        CVE-2019-13377
Title:    WPA3 Timing Based Side Channel Vulnerability
Vendor:    WPA3
Description: New Side-Channel Attack against WPA3 exists when using brainpool curves. The first vulnerability is a timing-based side-channel attack against WPA3's Dragonfly handshake when using Brainpool curves, which the WiFi Alliance recommended vendors to use as one of the security recommendations to add another layer of security. The new side-channel leak is located in the password encoding algorithm of Dragonfly.
CVSS v2 Base Score: 5.4 

ID:        CVE-2019-14234
Title:    Django JSONField SQL injection Vulnerability
Vendor:    Django
Description: Key and index lookups for django.contrib.postgres.fields.JSONField and key lookups for django.contrib.postgres.fields.HStoreField were subject to SQL injection, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to QuerySet.filter().
CVSS v2 Base Score: 5.0 

ID:        CVE-2019-13143
Title:    FB50 Smart Lock Information Disclosure Vulnerability
Vendor:    Shenzhen Dragon Brother Technology
Description: An HTTP parameter pollution issue was discovered on Shenzhen Dragon Brothers Fingerprint Bluetooth Round Padlock FB50 2.3. With the user ID, user name, and the lock's MAC address, anyone can unbind the existing owner of the lock, and bind themselves instead. This leads to complete takeover of the lock. The user ID, name, and MAC address are trivially obtained from APIs found within the Android or iOS application. With only the MAC address of the lock, any attacker can transfer ownership of the lock from the current user, over to the attacker's account. Thus rendering the lock completely inaccessible to the current user.
CVSS v2 Base Score: 4.0 

ID:        CVE-2019-14697
Title:    musl libc x87 Stack Overflow Vulnerability
Vendor:    musl libc
Description: musl libc has an x87 floating-point stack adjustment imbalance, related to the math/i386/ directory. In some cases, use of this library could introduce out-of-bounds writes that are not present in an application's source code.    This can lead to x87 stack overflow in the execution of subsequent math code, causing it to incorrectly produce a NAN in place of the actual result.
CVSS v2 Base Score: 3.6 

ID:        CVE-2019-14286
Title:    Misp Cross Site Scripting Vulnerability
Vendor:    Misp
Description: In app/webroot/js/event-graph.js in MISP, a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.
CVSS v2 Base Score: 4.3 

ID:        CVE-2019-14654
Title:    Joomla Remote code Execution Vulnerability
Vendor:    Joomla
Description: In Joomla!, inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option.In other words, the filter attribute in subform fields allows remote code execution.
CVSS v2 Base Score: 5.0 

Vulnerabilities

Jenkins Credentials Binding Plugin CVE-2019-1010241 Information Disclosure Vulnerability
2019-07-26
securityfocus.com/bid/109320

Qualcomm Components CVE-2019-2307 Integer Underflow Vulnerability
2019-07-26
securityfocus.com/bid/109383

LibreOffice Remote Code Execution and Unauthorized Access Vulnerabilities
2019-07-26
securityfocus.com/bid/109374

KDE KAuth CVE-2017-8422 Local Privilege Escalation Vulnerability
2019-07-25
securityfocus.com/bid/98412

FreeBSD CVE-2019-5604 Out of Bounds Read Denial of Service Vulnerability
2019-07-25
securityfocus.com/bid/109369

Exim CVE-2019-13917 Privilege Escalation Vulnerability
2019-07-24
securityfocus.com/bid/109338

Libdwarf CVE-2019-14249 Remote Denial Of Service Vulnerability
2019-07-24
securityfocus.com/bid/109380

McAfee Data Loss Prevention Endpoint for Windows Multiple Local Security Vulnerabilities
2019-07-24
securityfocus.com/bid/109377