Threat Intelligence Report - October 7-13 2019

Trends

• The top attacker country was China with 2639 unique attackers (31%)
• The top Exploit event was Authentication with 60% of occurrences.
• The top Trojan C&C server detected was Trickbot with 43 instances detected.

Top Attacker by Country

Threat Geo-location

Top Attacking Hosts

Top Network Attackers

Top Event NIDS and Exploits

Top Alarms

Comparison from last week 

Remote Access Trojan C&C Servers Found

Common Malware

CVEs For Which Public Exploits Have Been Detected

ID:        CVE-2019-11932
Title:    Anchor CMS Information Disclosure Vulnerability
Vendor:    Anchor CMS
Description: A double free vulnerability in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif as used in WhatsApp for Android, allows remote attackers to execute arbitrary code or cause a denial of service. By default, AnchorCMS will log errors to the "/anchor/errors.log" file in the webroot of the web application. This allows malicious users to access the error log and view potentially sensitive information.
CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-1367
Title:    Microsoft Scripting Engine Memory Corruption Vulnerability
Vendor:    Microsoft
Description: A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. This CVE ID is unique from CVE-2019-1221.
CVSS v2 Base Score:    7.6 (AV:N/AC:H/Au:N/C:C/I:C/A:C)

ID:        CVE-2019-1315
Title:    Microsoft Windows Error Reporting Privilege Escalation Vulnerability
Vendor:    Microsoft
Description: Microsoft Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of hard links by the Error Reporting manager. By executing a specially-crafted program, an authenticated attacker could exploit this vulnerability to take control of the system.
CVSS v2 Base Score:    7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)

ID:        CVE-2019-16920
Title:    D-Link Unauthenticated Command-Injection Vulnerability
Vendor:    D-Link
Description: The vulnerability exists in the latest firmware for the DIR-655, DIR-866L, DIR-652 and DHP-1565 products, which are Wi-Fi routers. The vulnerability exists due to improper sanitization of arbitrary commands that are executed by the native command-execution function. An attacker who successfully triggers the command injection could achieve full system compromise.
Fortinet's FortiGuard Labs has discovered an unauthenticated remote code execution vulnerability in D-Link products.
CVSS v2 Base Score:    10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C)

ID:        CVE-2019-17132
Title:    vBulletin Authenticated Remote Code Execution Vulnerability
Vendor:    vBulletin
Description: A remote code execution vulnerability exist in User input passed through the "data[extension]" and "data[filedata]" parameters to the "ajax/api/user/updateAvatar" endpoint, that is not properly validated before being used to update users avatars. This can be exploited to inject and execute arbitrary PHP code. Successful exploitation of this vulnerability requires the "Save Avatars as Files" option to be enabled (disabled by default).
CVSS v2 Base Score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)

ID:        CVE-2019-4013
Title:    IBM Bigfix Platform Arbitrary File Upload Vulnerability
Vendor:    IBM
Description: IBM BigFix Platform could allow any authenticated user to upload any file to any location on the server with root privileges. This results in code execution on underlying system with root privileges. An attacker can for example upload script file on the web server and execute it by sending GET request.
CVSS v2 Base Score:    9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)