A week in security (July 6 – 12)

Last week on Malwarebytes Labs, we took an in-depth look at card skimmers targeting ASP sites, we released another episode of Lock and Code exploring the Internet of Things, and we dug into a Mac mystery. We also examined some pre-installed malware, and put out a threat spotlight on some customiz...

'Undeletable' Malware Shows Up in Yet Another Android Device

Security researchers have identified yet another Android-based mobile device available through the government-funded Lifeline Assistance Program pre-loaded with malware, a discovery adding evidence to the disturbing trend of smartphones infected with undeletable malicious code upon purchase. Hard...

We found yet another phone with pre-installed malware via the Lifeline Assistance program

We have discovered, yet again, another phone model with pre-installed malware provided from the Lifeline Assistance program via Assurance Wireless by Virgin Mobile. This time, an ANS American Network Solutions UL40 running Android OS 7.1.1. After our writing back in January—"United States...

Symantec Critical System Protection/Data Center Security Agent (Windows)

Binary data symantecdatacentersecurityagentwininstalled.nbin...

Symantec Data Center Security Server Installed (Windows)

Binary data symantecdcslocaldetect.nbin...

The vulnerability of the Cisco IOS operating system’s virtual console, related to the use of pre-installed credentials, allows a perpetrator to gain access to the system and execute arbitrary commands with root privileges.

The vulnerability of the Cisco IOS virtual console is related to the use of pre-installed credentials. Exploiting this vulnerability can allow a perpetrator to gain access to the system and execute arbitrary commands with root privileges...

Cisco Webex Meetings Desktop App Installed (Mac OS X)

Binary data macosxciscowebexmeetingsdesktopappinstalled.nbin...

CVE-2020-4050

In affected versions of WordPress, misuse of the set-screen-option filter's return value allows arbitrary user meta fields to be saved. It does require an admin to install a plugin that would misuse the filter. Once installed, it can be leveraged by low privileged users. This has been patched in...

DSA-4698-1 linux - security update

Bulletin has no description...

ShareFile Storage Zones Controller Installed (Windows)

Binary data citrixsharefilecontrollerwininstalled.nbin...

Oracle Business Process Management Installed

Binary data oraclebpminstalled.nbin...

RHEL 7 : qemu-kvm-ma (RHSA-2020:2065)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2065 advisory. Kernel-based Virtual Machine KVM is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-ma packages provide the...

Microsoft Dynamics NAV Server Installed (Windows)

Binary data microsoftdynamicsnavserverwininstalled.nbin...

The vulnerability of the TriStation 1131 security logic analysis software lies in the presence of a pre-installed account, which allows a perpetrator to gain unauthorized access to the TriStation host machine.

The vulnerability of the TriStation 1131 security logic analysis software is related to the presence of a pre-installed account. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to the TriStation host machine...

libreoffice: LibreLogo global-event script execution

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers...

Autodesk FBX-SDK Library Installed

Binary data autodeskfbx-sdkdetectwin.nbin...

The vulnerability of Microsoft Windows Defender operating system, which allows a hacker to increase their privileges

The vulnerability of Microsoft Windows Defender operating system is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow attackers to increase their privileges...

Unspecified Vulnerability in SAP Business Client

SAP Business Client is a business client software from SAP Germany. A security vulnerability exists in SAP Business Client versions 6.5 and 7.0, which can be exploited by attackers to modify the installed program...

Trend Micro Deep Security Agent Installed (Linux)

Binary data trendmicrodeepsecurityagentlinuxinstalled.nbin...

Puppet Detection (HTTP)

Checks whether Puppet is present on the target system and if so, tries to figure out the installed version. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General...