{"rst": [{"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **45[.]94.232.67** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **12**.\n First seen: 2020-12-21T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **generic**.\nASN 203020: (First IP 45.94.232.0, Last IP 45.94.235.255).\nASN Name \"JMJ\" and Organisation \"\".\nASN hosts 746 domains.\nGEO IP information: City \"Madrid\", Country \"Spain\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-12-21T00:00:00", "id": "RST:9CDBD68E-1368-3113-8770-70BC0816315A", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: 45.94.232.67", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **118[.]126.65.27** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **29**.\n First seen: 2021-02-06T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **generic**.\nASN 45090: (First IP 118.126.64.0, Last IP 118.126.119.255).\nASN Name \"CNNICTENCENTNETAP\" and Organisation \"Shenzhen Tencent Computer Systems Company Limited\".\nASN hosts 483346 domains.\nGEO IP information: City \"\", Country \"China\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-02-06T00:00:00", "id": "RST:1EB99A7E-1368-33D5-8D28-89173CB77A72", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: 118.126.65.27", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **221[.]133.7.121** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **12**.\n First seen: 2020-12-22T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **generic**.\nASN 7602: (First IP 221.133.0.0, Last IP 221.133.12.131).\nASN Name \"SPTASVN\" and Organisation \"Saigon Postel Corporation\".\nASN hosts 695 domains.\nGEO IP information: City \"Haiphong\", Country \"Vietnam\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-12-22T00:00:00", "id": "RST:0452A9B7-1368-3CA6-89CC-D044DE472F44", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: 221.133.7.121", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **217[.]160.0.231** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **10**.\n First seen: 2020-03-20T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **generic**.\nASN 8560: (First IP 217.160.0.0, Last IP 217.160.83.255).\nASN Name \"ONEANDONEAS\" and Organisation \"Brauerstrasse 48\".\nASN hosts 11381073 domains.\nGEO IP information: City \"\", Country \"Germany\".\nIOC could be a **False Positive** (Cloud provider IP).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-03-20T00:00:00", "id": "RST:1E6026FA-1368-338F-8E68-1A1299A3B6B3", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: 217.160.0.231", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **jeanette-farrow[.]me** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2019-12-15T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **spam**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2019-12-15T00:00:00", "id": "RST:31467C0D-1368-395C-A557-92EF953370F8", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: jeanette-farrow.me", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **whicisimp[.]rest** in [RST Threat Feed](https://rstcloud.net/profeed) with score **2**.\n First seen: 2020-02-24T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **spam**.\nDomain has DNS A records: 198[.]54.117.197,198.54.117.198,198.54.117.199,198.54.117.200\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-02-24T00:00:00", "id": "RST:4F278AD3-1368-37AE-9C2A-9899A604C73E", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: whicisimp.rest", "type": "rst", "cvss": {}}, {"lastseen": "2021-03-05T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **https://onedrive[.]live.com/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c** in [RST Threat Feed](https://rstcloud.net/profeed) with score **30**.\n First seen: 2021-01-05T03:00:00, Last seen: 2021-03-05T03:00:00.\n IOC tags: **malware, generic**.\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-01-05T00:00:00", "id": "RST:C2BF98A6-3B13-37B5-846B-660DAD2ED7D1", "href": "", "published": "2021-03-06T00:00:00", "title": "RST Threat feed. IOC: https://onedrive.live.com/download?cid=f7ae097903082806&resid=f7ae097903082806!1368&authkey=anphh1fijhvzv6c", "type": "rst", "cvss": {}}, {"lastseen": "2020-12-22T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **61[.]19.202.212** in [RST Threat Feed](https://www.rstcloud.net/profeed) with score **5**.\n First seen: 2020-04-28T03:00:00, Last seen: 2020-12-22T03:00:00.\n IOC tags: **generic**.\nASN 9931: (First IP 61.19.191.0, Last IP 61.19.203.255).\nASN Name \"CATAP\" and Organisation \"The Communication Authoity of Thailand CAT\".\nASN hosts 2436 domains.\nGEO IP information: City \"Nakhon Si Thammarat\", Country \"Thailand\".\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-04-28T00:00:00", "id": "RST:F42EE96D-1368-3B77-9829-1131BB379F94", "href": "", "published": "2021-03-05T00:00:00", "title": "RST Threat feed. IOC: 61.19.202.212", "type": "rst", "cvss": {}}, {"lastseen": "2021-01-17T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **enduro-software[.]evolution-project.go.ro** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2020-11-06T03:00:00, Last seen: 2021-01-17T03:00:00.\n IOC tags: **cryptomining**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2020-11-06T00:00:00", "id": "RST:717725D7-1368-33E1-878E-D6A483947BF2", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: enduro-software.evolution-project.go.ro", "type": "rst", "cvss": {}}, {"lastseen": "2021-01-17T00:00:00", "bulletinFamily": "ioc", "cvelist": [], "description": "Found **nbinarium-v1[.]eu.mine.eu.mine.eu.mine.zpool.ca** in [RST Threat Feed](https://rstcloud.net/profeed) with score **10**.\n First seen: 2021-01-17T03:00:00, Last seen: 2021-01-17T03:00:00.\n IOC tags: **cryptomining**.\nIOC could be a **False Positive** (Domain not resolved. Whois records not found).\n[https://rstcloud.net/](https://rstcloud.net/)", "edition": 1, "modified": "2021-01-17T00:00:00", "id": "RST:7975A3F7-1368-324F-8A70-DB4B0139DB7E", "href": "", "published": "2021-02-24T00:00:00", "title": "RST Threat feed. IOC: nbinarium-v1.eu.mine.eu.mine.eu.mine.zpool.ca", "type": "rst", "cvss": {}}], "cve": [{"lastseen": "2021-03-04T16:37:10", "description": "A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted Cisco UDLD protocol packets to a directly connected, affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the Cisco UDLD process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: The UDLD feature is disabled by default, and the conditions to exploit this vulnerability are strict. The attacker needs full control of a directly connected device. That device must be connected over a port channel that has UDLD enabled. To trigger arbitrary code execution, both the UDLD-enabled port channel and specific system conditions must exist. In the absence of either the UDLD-enabled port channel or the system conditions, attempts to exploit this vulnerability will result in a DoS condition. It is possible, but highly unlikely, that an attacker could control the necessary conditions for exploitation. The CVSS score reflects this possibility. However, given the complexity of exploitation, Cisco has assigned a Medium Security Impact Rating (SIR) to this vulnerability.", "edition": 3, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-02-24T20:15:00", "title": "CVE-2021-1368", "type": "cve", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 4.4, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.9, "vectorString": "AV:A/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1368"], "modified": "2021-03-03T19:22:00", "cpe": ["cpe:/o:cisco:nx-os:8.4\\(3.117\\)", "cpe:/o:cisco:nx-os:7.3\\(8\\)n1\\(1\\)", "cpe:/o:cisco:nx-os:9.3\\(5\\)", "cpe:/o:cisco:nx-os:8.4\\(3.108\\)", "cpe:/o:cisco:nx-os:7.0\\(3\\)i5\\(2\\)", "cpe:/o:cisco:fxos:r231", "cpe:/o:cisco:nx-os:7.3\\(9\\)n1\\(0.823\\)", "cpe:/o:cisco:nx-os:7.0\\(3\\)i7\\(9\\)"], "id": "CVE-2021-1368", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1368", "cvss": {"score": 4.9, "vector": "AV:A/AC:M/Au:S/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:cisco:nx-os:8.4\\(3.108\\):*:*:*:*:*:*:*", "cpe:2.3:o:cisco:nx-os:7.0\\(3\\)i5\\(2\\):*:*:*:*:*:*:*", "cpe:2.3:o:cisco:fxos:r231:*:*:*:*:*:*:*", "cpe:2.3:o:cisco:nx-os:7.3\\(8\\)n1\\(1\\):*:*:*:*:*:*:*", "cpe:2.3:o:cisco:nx-os:7.3\\(9\\)n1\\(0.823\\):*:*:*:*:*:*:*", "cpe:2.3:o:cisco:nx-os:7.0\\(3\\)i7\\(9\\):*:*:*:*:*:*:*", "cpe:2.3:o:cisco:nx-os:9.3\\(5\\):*:*:*:*:*:*:*", "cpe:2.3:o:cisco:nx-os:8.4\\(3.117\\):*:*:*:*:*:*:*"]}], "cisco": [{"lastseen": "2021-02-24T16:27:07", "bulletinFamily": "software", "cvelist": ["CVE-2021-1368"], "description": "A vulnerability in the Unidirectional Link Detection (UDLD) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device.\n\nThis vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted Cisco UDLD protocol packets to a directly connected, affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the Cisco UDLD process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition.\n\nNote: The UDLD feature is disabled by default, and the conditions to exploit this vulnerability are strict. The attacker needs full control of a directly connected device. That device must be connected over a port channel that has UDLD enabled. To trigger arbitrary code execution, both the UDLD-enabled port channel and specific system conditions must exist. In the absence of either the UDLD-enabled port channel or the system conditions, attempts to exploit this vulnerability will result in a DoS condition.\n\nIt is possible, but highly unlikely, that an attacker could control the necessary conditions for exploitation. The CVSS score reflects this possibility. However, given the complexity of exploitation, Cisco has assigned a Medium Security Impact Rating (SIR) to this vulnerability.\n\nCisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.\n\nThis advisory is available at the following link:\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-udld-rce-xetH6w35 [\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-udld-rce-xetH6w35\"]", "modified": "2021-02-24T16:00:00", "published": "2021-02-24T16:00:00", "id": "CISCO-SA-NXOS-UDLD-RCE-XETH6W35", "href": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-udld-rce-xetH6w35", "type": "cisco", "title": "Cisco FXOS and NX-OS Software Unidirectional Link Detection Denial of Service and Arbitrary Code Execution Vulnerability", "cvss": {"score": 8.8, "vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "nessus": [{"lastseen": "2021-02-25T17:09:37", "description": "According to the version of the texlive packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - An issue was discovered in t1_check_unusual_charstring\n functions in writet1.c files in TeX Live before\n 2018-09-21. A buffer overflow in the handling of Type 1\n fonts allows arbitrary code execution when a malicious\n font is loaded by one of the vulnerable tools:\n pdflatex, pdftex, dvips, or luatex.(CVE-2018-17407)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 2, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2021-02-22T00:00:00", "title": "EulerOS 2.0 SP2 : texlive (EulerOS-SA-2021-1368)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-17407"], "modified": "2021-02-22T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:texlive-base", "p-cpe:/a:huawei:euleros:texlive", "p-cpe:/a:huawei:euleros:texlive-kpathsea-lib", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2021-1368.NASL", "href": "https://www.tenable.com/plugins/nessus/146756", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(146756);\n script_version(\"1.2\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/02/24\");\n\n script_cve_id(\n \"CVE-2018-17407\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : texlive (EulerOS-SA-2021-1368)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the texlive packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - An issue was discovered in t1_check_unusual_charstring\n functions in writet1.c files in TeX Live before\n 2018-09-21. A buffer overflow in the handling of Type 1\n fonts allows arbitrary code execution when a malicious\n font is loaded by one of the vulnerable tools:\n pdflatex, pdftex, dvips, or luatex.(CVE-2018-17407)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2021-1368\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?46239e26\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected texlive package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/02/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/02/22\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:texlive\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:texlive-base\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:texlive-kpathsea-lib\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"texlive-2012-38.20130427_r30134.h4\",\n \"texlive-base-2012-38.20130427_r30134.h4\",\n \"texlive-kpathsea-lib-2012-38.20130427_r30134.h4\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"texlive\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}]}
