Microsoft Office Word Malicious Macro Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'rex/zip' class MetasploitModule "Microsoft Office Word Malicious Macro Execution", 'Description' = %q This module generates a macro-enabled...

CVE-2016-10043

An issue was discovered in Radisys MRF Web Panel SWMS 9.0.1. The MSMMACRONAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character | to inject arbitrary OS commands and retrieve the output in the application's...

Spammers Revive Hancitor Downloader Campaigns

A recent lull in the distribution of spam spreading information-stealing malware via the Hancitor downloader has been snapped. Researchers at the SANS Internet Storm Center are currently tracking an increase in spam purporting to be a forwarded parking ticket notification. The message prompts the...

MS12-021: Description of the security update for Visual Studio 2008 Service Pack 1: March 13, 2012

MS12-021: Description of the security update for Visual Studio 2008 Service Pack 1: March 13, 2012 Introduction Microsoft has released the security bulletin MS12-021. You can view the complete security bulletin by visiting one of the following Microsoft websites: Home users:...

New Wave of Hailstorm Spam Pelts Inboxes

Spammers are turning to an old technique known as hailstorm to slip past anti-spam and anti-malware filters. Researchers say that hailstorm spam, first spotted in 2008, has been improved and is once again being used, only this time to spread Dridex banking malware and Locky ransomware. “Hailstorm...

DEBIAN-CVE-2016-9178

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel before 4.7.5 does not initialize a certain integer variable, which allows local users to obtain sensitive information from kernel stack memory by triggering failure of a getuserex call...

CVE-2016-9644

The getuserasmex macro in arch/x86/include/asm/uaccess.h in the Linux kernel 4.4.22 through 4.4.28 contains extended asm statements that are incompatible with the exception table, which allows local users to obtain root access on non-SMEP platforms via a crafted application. NOTE: this...

Nymaim Dropper Updates Delivery, Obfuscation Methods

A new variant of the Nymaim dropper has been identified that includes updated delivery and obfuscation methods, and the use of PowerShell routines to download its payloads. The updated dropper, used primarily to download banking Trojans in the past, has also been spreading ransomware, according t...

Microsoft Extends Macro Protection to Office 2013

Microsoft is combating a surge in macro-based malware with a new feature that allows system administrators to configure Office 2013 to block Word, Excel, and PowerPoint macros. The capability had previously been introduced in March by Microsoft for its Office 2016 software. Microsoft said inciden...

Macro Expert Elevation of Privilege Vulnerability

Macro Expert is a mouse macro creation tool that records mouse movements and stores them as related macro actions. An elevation of privilege vulnerability exists in Macro Expert version 4.0, which can be exploited by attackers to cause an elevation of privilege...

Microsoft Excel Files Containing Malicious Macro

Microsoft Excel files might contain a malicious macros. A remote attacker could send spam e-mails including those macros, and use social engineering in order to convince users to manually enable them. This would allow the malicious code to run and infect the target system...

Macro Expert 4.0 - Multiple Privilege Escalations

Exploit for windows platform in category local exploits Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege Date: 26/09/2016 Exploit Author: Tulpa Contact: email protected Author website: www.tulpa-security.com Vendor Homepage: http://www.macro-expert.com/ Software Link:...

Macro Expert 4.0 Privilege Escalation

Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege Date: 26/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.macro-expert.com/ Software Link: http://www.macro-expert.com/download.htm Version: Software...

Macro Expert 4.0 - Multiple Privilege Escalations

Macro Expert 4.0 - Multiple Privilege Escalations Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege Date: 26/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.macro-expert.com/ Software Link:...

Macro Expert 4.0 - Multiple Privilege Escalations

Exploit Title: Macro Expert 4.0 Multiple Elevation of Privilege Date: 26/09/2016 Exploit Author: Tulpa Contact: [email protected] Author website: www.tulpa-security.com Vendor Homepage: http://www.macro-expert.com/ Software Link: http://www.macro-expert.com/download.htm Version: Software...

Hancitor (AKA Chanitor) observed using multiple attack approaches

Many threat actors use multiple attack vectors to ensure success. The individuals using Hancitor malware also known by the name Chanitor are no exception and have taken three approaches to deliver the malware in order to ultimately steal data from their victims. These techniques include uncommon...

Hancitor (AKA Chanitor) observed using multiple attack approaches

Many threat actors use multiple attack vectors to ensure success. The individuals using Hancitor malware also known by the name Chanitor are no exception and have taken three approaches to deliver the malware in order to ultimately steal data from their victims. These techniques include uncommon...

Malware Evades Detection with Novel Technique

Researchers have found a new strain of document-based macro malware that evades discovery by lying dormant when it detects a security researcher’s test environment. The malware, according to researcher Caleb Fenton with security firm SentinelOne, evades detection simply by counting the number of...

java-1.6.0-openjdk security update

1:1.6.0.40-1.13.12.4.0.1 - Add oracle-enterprise.patch 1:1.6.0.40-1.13.12.4 - Bump source tarballs to try and really fix TCK failures this time. - Resolves: rhbz1350043 1:1.6.0.40-1.13.12.3 - Bump source tarballs to missing -DNDEBUG on JDK native code. - Resolves: rhbz1350043 1:1.6.0.40-1.13.12.2...

Locky Ransomware Distributed Via DOCM Attachments in Latest Email Campaigns

Throughout August, FireEye Labs has observed a few massive email campaigns distributing Locky ransomware. The campaigns have affected various industries, with the healthcare industry being hit the hardest based on our telemetry, as seen in Figure 1. Figure 1. Top 10 affected industries Numerous...