Vulnerabilitymedium
CVE-2019-10149: “Return of the WiZard” Vulnerability: Crooks Start Hitting
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-10149 | Unvalidated Email Recipient Enables Remote Command Execution in Exim MTA | 9.8 | 100% | KEVPoC ×5 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 1c8f184c3cf902bafc9df23b13a5d51cf801026bc3bde9d6b05cf047523ac6ed | er locally executes the crafted part. The Bash Stealer Hash 1c8f184c3cf902bafc9df23b13a5d51cf801026bc3bde9d6b05cf047523ac6ed Threat Bash Stealer Brief Description Initial bash payload |
| sha256 | b4bae03ab71439208b79edfc5eaec42babacee982231dce001b70ec42835063a | the standard UPX compressor. The unpacked payload is: Hash b4bae03ab71439208b79edfc5eaec42babacee982231dce001b70ec42835063a Threat ELF Uploader unpacked Brief Description ELF Uploader |
| sha256 | d8a787dc774748bf26e3dce1b079e9bef071c0327b6adcd8cc71ed956365201c | referenced in the “ snd() ” function. The ELF Uploader Hash d8a787dc774748bf26e3dce1b079e9bef071c0327b6adcd8cc71ed956365201c Threat ELF Uploader Brief Description Malware downloaded af |
| url | http://173[.212.214[.137/se | malware: an ELF32 executable hosted on the same server at “ hxxp://173[.212.214[.137/se ”. It is the “atd” file referenced in the “ snd() ” functio |
| url | https://85[.25.84.99/up[.php” | iable is “ UPLOAD_URL ” containing a first remote location “hxxps://85[.25.84.99/up[.php” part of the attacker infrastructure. The C2 is hosted by a |
From the original article
7 min read at securityaffairs.com
Malware researchers at Cybaze-Yoroi ZLAB observed many attack attempts trying to spread malware abusing the CVE-2019-10149 issue. Figure 1: Exposed EXIM server in Italy (Reference: ZoomEye ) In the past days, a really important issue has been disclosed to the public: “ Return of the WiZard ” vulnerability (ref. EW N030619 , CVE-2019-10149 ).
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.