What does it do?

In an unfortunate and ironic turn of events, a workaround XML file for an RCE deactivates protection for an earlier RCE workaround. The released patch, according to the Threatpost article, “...may allow for an unauthenticated, remote attacker to execute code as a user with root privileges”. From the CERT Coordination Center report and Threatpost:

“When specifying a long server name for some SMB operations, the smbclt application may crash due to either a stack buffer overflow or a heap buffer overflow, depending on how long of a server name is specified,” CERT/CC noted. PCS 9.1R11.4 systems are vulnerable: CERT/CC said that it’s managed to trigger the vulnerability by targeting the CGI script /dana/fb/smb/wnf.cgi, although “Other CGI endpoints may also trigger the vulnerable code.”

What does it do?

This vulnerability allows for a guest virtual machine to create conditions for a denial of service on the Hyper-V host kernel by forcing an invalid kernel read address. Though all of the potential for this vulnerability is not yet known, hardware-specific side effects related to devices attached to the Hyper-V host could cause abnormalities and possible further vulnerabilities.

What does it do?

Solarwinds vulnerability exploitation is on the rise, and this CVE is an interesting example. No authentication is necessary to exploit this vulnerability. Due to a lack of properly validated user-supplied data, deserialization may be performed and arbitrary code execution could then take place.

Summary

A lot of Windows programs are going to be launching, running, being installed, and working on a large network, especially one that has a more exclusive focus on Windows deployment. It is understandable, then, that finding malware masquerading as a Windows binary can be rather difficult and time consuming. In one case this month, a malware install alert was triggered on a binary that otherwise appeared normal. Using the automated solution below, an impressive near-exact clone of Microsoft Office was found, with binaries that were just in different paths than usual. Along with a unique conversation from the machine in question to an IP with a bad reputation, the machine was marked for quarantine, a sweep for similar incidents performed, and the end machine cleaned.

Automated Solution

In the LogicHub solution against binary masquerading, we first search for indicators of normality: in the case above, that was ensuring that binary paths were normal in every detection and searching for unique firewall conversations. After the initial process of correlating logs and sources, each alarm on a Windows binary is checked against known binary paths. IPs involved in potentially unusual activity or excessive conversations are automatically checked in batches against a series of reputation websites. All of this data is correlated and scored according to possibility of compromise, and a case is opened if that score crosses a client-specified threshold.