Hello and welcome to the Tuesday, June 16th,

2006 edition of the Sands International Storm Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Sands.edu underwrite certificate program in applied cyber security.

Well, I always love DDA's follow-up diaries to any kind of malware that Xavier discovered earlier.

Saville last week discovered this malware that was sort of hidden inside this MSI wallpaper.

While the DEA now shows us how to use his base 64 decode tools in order to essentially figure out

how the particular string here or the malware is encoded and how to extract it from the image. This is kind of a little bit

interesting here. It's B-604 encoded, but there are two letters swapped. The A's are swapped for the

number symbol. And then the string is also basically just used in reverse. So it starts with the equal equal symbol, which, well, usually you have at the end of the base 64 encoded string.

So interesting little trick here and the DDA walks us also through some of the dead end that he ran into using these tools,

which is obvious I I think, more realistic

and also more educational, because you may run into those same dead ends yourself and they

will show you how to overcome these dead ends. And Cisco released advisory and a fix

to address a vulnerability in the Cisco Catalyst SDWAN manager.

This vulnerability is an arbitrary file right vulnerability, and of course with that can lead to

arbitrary code execution. Now, why is this only rated as a medium by Cisco?

The main reason here is that this requires valid

credentials, so you have to be authenticated in order to exploit the vulnerability, even though

this CFSS score of 6.5, maybe a little bit low here. The other thing that makes me talk about this vulnerability is that it's already being

exploited in the wild.

Cisco does have an addition kind of at the end of the advisory stating that as of June,

...