Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware
Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware
Executive summary
An active campaign has been identified in which a flaw in Foxit, a popular PDF reader, is being exploited by attackers to deploy a variety of malware. Check Point, who have identified the campaign have said that it has been used by multiple threat actors in campaigns ranging “from e-crime to espionage”. The campaign takes advantage of a flaw in which the PDF reader is set to accept a document as trusted by default. Once a user clicks OK on this, a second display pops up which has the default option of allowing the PDF to open additional programs and execute commands.
What’s the risk to me or my business?
There is a risk that organisations using Foxit PDF reader are vulnerable to this exploitation, which has a low detection rate. Additionally, this risk extends to employees who have access to corporate data on their personal device and are using Foxit. In both cases, the confidentiality, integrity and availability of information is at risk.
Reports indicate that the malicious PDF’s are being distributed in traditional manners including email, as well as social media such as Facebook, capitalising on the low-level of detection of this exploit.
What can I do?
Black Arrow recommends organisations evaluate the most suitable risk treatment approach for their environment. This may involve exploring alternative software solutions or uninstalling the affected software altogether. Additionally, disabling non-essential features, such as command prompt and PowerShell execution, for standard users is recommended. Cyber awareness training should also emphasise the importance of not opening unexpected files or granting permissions via pop-up windows to mitigate risks.
#threatadvisory #threatintelligence #cybersecurity
Further information from Check Point can be found here:
https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/
Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates
Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates
Executive summary
Microsoft’s May Patch Tuesday provides updates to address 61 security issues across its product range. Notably, the update tackles two actively exploited zero-day vulnerabilities. The zero-days include a security feature bypass and an elevation of privilege vulnerability. Among the updates provided by Microsoft were 1 critical vulnerability, allowing an attacker remote code execution.
In addition to the Microsoft updates this week also saw Adobe, Apple, Firefox, Google Chrome, SAP and VMware all provide updates for vulnerabilities in a variety of their products, including multiple zero-days and critical vulnerabilities.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an unauthenticated attacker to gain code execution as well as elevating to system privileges, the highest available. Both of which compromise the confidentiality, integrity and availability of data stored by an organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have an available patch should be updated as soon as possible.
Technical Summary
Microsoft
CVE-2024-30040 – A security feature bypass, in which an unauthenticated attacker can gain code execution through convincing a user to open a malicious document. It is now known how this flaw was abused in attacks.
CVE-2024-30051- A flaw in Windows DWM Core Library which upon exploitation, allows an attacker to elevate to system privileges, the highest available.
Apple
Apple have addressed multiple vulnerabilities in its products, including 16 vulnerabilities on iPhone and iPads. This includes include one vulnerability which the company say “may have been exploited”.
Adobe
Adobe have addressed 37 vulnerabilities in its products, including 9 critical vulnerabilities in Adobe Acrobat and Reader, , 2 critical vulnerabilities in Adobe Commerce, Adobe InDesign, Adobe Experience manager, 1 critical vulnerability in Adobe Media Encoder and Adobe Bridge, 3 critical vulnerabilities in Adobe Illustrator and 2 critical vulnerabilities in Adobe Animate. The company said it was not aware of any exploits in the wild for any of the documented issues.
Firefox
Firefox has upgraded to version 126. The new version addresses 16 unique security issues. None of the vulnerabilities are currently under active exploitation. The release also comes with some quality-of-life changes such as search telemetry changes and copy link without site tracking.
Google Chrome
Google Chrome released an emergency update to fix their 6th zero-day exploited this year, just one week after a previous one. Google are aware that an exploit for the vulnerability exists in the wild. Users are recommended to update as soon as possible.
SAP
This month, SAP has released 17 patches, which include 14 new fixes and 3 updates from previous releases. Two patches and one update have been given the “hot news” priority in SAP, the highest severity. The vulnerabilities encompass a range of issues, including CSS Injection, Remote Code Execution, File Upload flaws, and Cross-Site Scripting (XSS).
VMWare
Multiple security flaws, including one critical vulnerability, have been addressed by VMware after their exploitation was demonstrated at a security event. Some of the vulnerabilities do not have a fix yet and as such, users are advised to disable Bluetooth support and 3D acceleration as temporary workarounds until patches are applied.
More info:
Microsoft
Further details on other specific updates within Microsoft’s May patch Tuesday can be found here:
https://www.ghacks.net/2024/05/14/microsoft-releases-the-may-2024-security-updates-for-windows/
Apple
Further details of the vulnerabilities in Apple can be found here:
https://support.apple.com/en-gb/HT201222
Adobe
Further details of the vulnerabilities in Adobe Acrobat and Reader can be found here:
https://helpx.adobe.com/security/products/acrobat/apsb24-29.html
Further details of the vulnerabilities in Adobe Photoshop can be found here:
https://helpx.adobe.com/security/products/photoshop/apsb24-16.html
Further details of the vulnerabilities in Adobe Commerce can be found here:
https://helpx.adobe.com/uk/security/products/magento/apsb24-18.html
Further details of the vulnerabilities in Adobe InDesign can be found here:
https://helpx.adobe.com/uk/security/products/indesign/apsb24-20.html
Further details of the vulnerabilities in Adobe Experience Manager can be found here:
https://helpx.adobe.com/uk/security/products/experience-manager/apsb24-21.html
Further details of the vulnerabilities in Adobe Media Encoder can be found here:
https://helpx.adobe.com/uk/security/products/media-encoder/apsb24-23.html
Further details of the vulnerabilities in Adobe Bridge can be found here:
https://helpx.adobe.com/uk/security/products/bridge/apsb24-24.html
Further details of the vulnerabilities in Adobe Illustrator can be found here:
https://helpx.adobe.com/uk/security/products/illustrator/apsb24-25.html
Further details of the vulnerabilities in Adobe Animate can be found here:
https://helpx.adobe.com/uk/security/products/animate/apsb24-26.html
Firefox
Further details on the vulnerabilities addressed in the Firefox release can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/
Google Chrome
Further details on the vulnerabilities addressed in the Google Chrome update can be found here:
https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html
SAP
Further details on the vulnerabilities addressed in SAP can be found here:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html
VMware
Further details on the vulnerabilities addressed by VMware can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 30 April 2024 – New Android Malware Disguised as Chrome Update can Steal Your Data and Access Your Banking Information
Black Arrow Cyber Advisory 30 April 2024 – New Android Malware Disguised as Chrome Update can Steal Your Data and Access Your Banking Information
Executive summary
A new strain of Android mobile malware dubbed “Brokewell” is being used to spread fake browser updates to steal user data. The malware has the ability to overlay banking application screens, capturing credentials without the users knowledge, as well as allowing remote access by an attacker. The malware has also been recorded as using popular ‘buy now, pay later’ service “Klarna” in addition to the fake Google Chrome update. Research indicates that the malware is in active development.
What’s the risk?
Due to the sensitive nature of the information sought by the malware, there is a genuine risk to the confidentiality and integrity of data. Features of the malware include the ability to overlay applications to steal user credentials and allow an attacker remote access, including the commands which record audio, take screenshots, access locations, and send communications from the victim phone.
The list of potential targets is extensive, especially so with many employees using personal devices for corporate purposes, including the storage of corporate credentials. A recent report from Google owned Mandiant found that 10% of intrusions began with evidence of stolen credentials.
What can I do?
It is recommended to employ a multi-layer defence to mitigate the risk of such malware succeeding. This should include only downloading updates from the official application in the Google Play store and enabling Google Play Protect will help to prevent malware. To further bolster defence, it is recommended that anti-virus applications are run in parallel.
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Further information can be found below:
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
Black Arrow Cyber Insight 25 April 2024 – Understanding Infostealers: The Malicious Software Targeting Your Information
Black Arrow Cyber Insight 25 April 2024 – Understanding Infostealers: The Malicious Software Targeting Your Information
Executive summary
A recent report conducted by Kaspersky found that nearly 10 million devices fell victim to data-stealing malware, also known as “InfoStealers” in 2023. Put simply, an InfoStealer is malware that is built to collect and transmit sensitive information to unauthorised parties. Once stolen and transmitted, this information can be used or sold. Unlike ransomware, which often announces its presence with dramatic demands, infostealers operate in the shadows, harvesting your information.
What’s the risk?
Due to the sensitive nature of the information sought by InfoStealers, there is a genuine risk to the confidentiality of data. The data sought by an InfoStealer can include credentials, financial information, cookies, MFA tokens, text files, and machine information. The list of potential targets is extensive, especially so with many employees storing their credentials on personal devices. In a recent report, Mandiant, which is owned by Google, found that 10% of intrusions began with evidence of stolen credentials.
Infostealers can be delivered in a variety of ways, including through malicious attachments, unofficial software downloads and compromised websites. InfoStealers often try to disguise themselves as legitimate, in some cases tricking a victim in to running them and keeping them on their device. Anti-virus is not enough to stop them.
What can I do?
Mitigating the threat of InfoStealers requires practicing robust cyber hygiene. Organisations should adhere to leading practices, including downloading software exclusively from official sources, exercising caution with email links and attachments and maintaining visibility of the software ecosystem within their corporate environment.
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 25 April 2024 – Cisco ASA and FTD Zero-days Exploited by Nation-state Hackers, Patch Now
Black Arrow Cyber Advisory 25 April 2024 – Cisco ASA and FTD Zero-days Exploited by Nation-state Hackers, Patch Now
Executive summary
Cisco has published a security advisory warning regarding an active attack campaign labelled as “ArcaneDoor”. The campaign involves threat actors exploiting vulnerabilities in Cisco Adaptive Security Appliance (ASA) or Cisco Firepower Threat Defense (FTD) to implant previously unknown malware, execute commands and exfiltrate data. Activity is thought to have begun in early January 2024.
What’s the risk to me or my business?
There is a risk that organisations running vulnerable software versions of Cisco ASA or FTD are leaving themselves at risk of allowing an attacker to implant malware, execute commands and exfiltrate data, impacting the confidentiality, integrity and availability of data. There is no current workaround, and Cisco advises to upgrade to a fixed software release immediately.
What can I do?
Black Arrow recommends following Cisco’s advice, and applying patches immediately. Additionally, organisations can also open a case with Cisco Technical Assistance Center, referencing the keyword “ArcaneDoor” to verify the integrity of their Cisco ASA or FTD devices. Further information on this can be found in the advisory provided by Cisco.
Technical Summary
CVE-2024-20353- a denial of service vulnerability impacting Cisco ASA and FTD software.
CVE-2024-20359- A privilege escalation vulnerability, which could allow an authenticated local attacker to execute code with the highest level of privilege. Administrator level privileges are required to exploit this vulnerability.
Further information can be found below.
The advisories provided by Cisco can be found here:
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Alert 19 April 2024 – Flaw in Popular PuTTY SSH Client Allows Recovery of Private Keys
Black Arrow Cyber Alert 19 April 2024 – Flaw in Popular PuTTY SSH Client Allows Recovery of Private Keys
Executive summary
PuTTY, popular with IT administrators as an open-source terminal emulator that supports SSH, telnet and other network file transfer protocols, is currently being exploited due to a weakness in how it generates cryptographic private keys. The exploitation of the flaw allows an attacker to gain access to the user’s private keys and achieve unauthorised access to SSH servers, with the potential for supply chain attacks if exploited. Cryptographic private keys are typically used and verified by a public key on a server, to ensure the users identity and communicate securely.
What’s the risk to me or my business?
Organisations using a vulnerable version of PuTTY or other software that utilises a vulnerable version are at risk of compromise and unauthorised access to their SSH servers, impacting the confidentiality, integrity and availability of the organisation.
It has been reported that to perform the exploit successfully and calculate a user’s private key, an attacker will need 58 signatures, which could be gained from different sources including signed Git commits or an attacker-owned SSH server which the victim logs in to.
The vulnerability impacts versions 068 to 0.80 of PuTTY, with a fix available in version 0.81.
In addition, the following third-party software has been confirmed as vulnerable, however more are likely to be identified as the full extent of the vulnerability becomes apparent:
FileZilla 3.24.1 – 3.66.5 (fixed in 3.67.0)
WinSCP 5.9.5 – 6.3.2 (fixed in 6.3.3)
TortoiseGit 2.4.0.2 – 2.15.0 (fixed in 2.15.0.1)
TortoiseSVN 1.10.0 – 1.14.6 (users are advised to configure TortoiseSVN to use Plink from the latest PuTTY 0.81 release until a patch becomes available)
What can I do?
Black Arrow recommends upgrading to PuTTY version 0.81, or later, immediately, where available. Organisations should also check if they are using any tools which implement a vulnerable version of PuTTY, this could be achieved with a network vulnerability scan across affected information assets. In addition to the above, organisations should assess if they have any signed Git commits, as these may be used by attackers to gain the signatures required to exploit the vulnerability.
If your organisation has identified the use of any NIST p521 keys generated by a vulnerable version of the tool, they should be replaced by new secure keys immediately, and again following identification and applying updates to affected vulnerable versions.
Technical Summary
CVE-2024-31497- A vulnerability in PuTTY that can allow attackers to recover private keys. The impacted key type is is 521-bit ECDSA, also known as NIST p521.
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Further information can be found here:
Black Arrow Cyber Alert 17 April 2024 – Major Palo Alto Security Flaw Actively Exploited by Highly Capable Actors
Black Arrow Cyber Alert 17 April 2024 – Major Palo Alto Security Flaw Actively Exploited by Highly Capable Actors
Executive summary
Palo Alto have issued a critical alert for an actively exploited attack in the GlobalProtect feature of PAN-OS software use in its firewall products. Successful exploitation allows an attacker to execute code with root privileges, the highest available. Third parties have since disclosed a proof of concept for the exploit.
What’s the risk to me or my business?
The exploit applies only to applicable only to PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls configured with GlobalProtect gateway or GlobalProtect portal. Organisations falling under this umbrella are leaving themselves at risk of allowing an attacker to perform code with root privileges, impacting the confidentiality, integrity and availability of data. Device telemetry does not need to be enabled for PAN-OS firewalls to be exposed to attacks related to this vulnerability. Cloud NGFW, Panorama appliances, and Prisma Access are not impacted by this vulnerability.
Whether you have a GlobalProtect gateway or GlobalProtect portal configured can be verified by checking for entries in your firewall web interface (Network > GlobalProtect > Gateways or Network > GlobalProtect > Portals).
Palo Alto has listed the following versions as vulnerable:
PAN-OS 10.2: < 11.1.0-h3, < 11.1.1-h1, < 11.1.2-h3
PAN-OS 11.0: < 11.0.2-h4, < 11.0.3-h10, < 11.0.4-h1
PAN-OS 11.1: < 10.2.5-h6, < 10.2.6-h3, < 10.2.7-h8, < 10.2.8-h3, < 10.2.9-h1
The issue is fixed in hotfix releases of PAN-OS 10.2.9-h1, PAN-OS 11.0.4-h1, PAN-OS 11.1.2-h3, and in all later PAN-OS versions. A full list of ETA’s of hotfixes are available in the advisory by Palo Alto.
What can I do?
Black Arrow recommends following Palo Alto’s advice and applying the available fixes immediately even if workarounds and mitigations have been applied as previous mitigations are no longer effective. If an update is not available, it is recommended that the advisory is checked to see when an one will be made available. The latest expected update is currently planned for 19 April 2024.
Technical Summary
CVE-2024-3400 - A command Injection Vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software which can allow an unauthenticated attacker to execute code with root privileges.
Further information can be found here:
https://security.paloaltonetworks.com/CVE-2024-3400
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 10 April 2024 – Microsoft Patch Tuesday, Adobe and SAP Updates
Black Arrow Cyber Advisory 10 April 2024 – Microsoft Patch Tuesday, Adobe and SAP Updates
Executive Summary
In Microsoft’s April Patch Tuesday, updates were released to rectify 149 security issues across its product range. Notably, the update tackles two actively exploited zero-day vulnerabilities which are being exploited in to deploy malware. The exploited zero-day vulnerabilities allow for the bypassing of security feature prompts on SmartScreen and malicious drivers to deploy backdoors. Among these, 67 specifically addressed Remote Code Execution vulnerabilities. Among the updates provided by Microsoft were 3 critical vulnerabilities.
In addition to the Microsoft updates this week also saw Adobe and SAP provide updates for vulnerabilities in a variety of their products, with multiple rated as critical.
What’s the risk to me or my business?
Successful exploitation of these vulnerabilities allow for an attacker to distribute malware to a vulnerable system, gain remote code execution, cause a denial of service and impact the confidentiality, integrity and availability of information.
What can I do?
All vulnerabilities with an available patch should be updated as soon as possible.
Technical Summary
Microsoft
CVE-2024-26234: This vulnerability is caused by a malicious driver that has been signed with a valid Microsoft Hardware Publisher Certificate. The driver is used to deploy a backdoor.
CVE-2024-29988: This vulnerability, if actively exploited, allows a malicious attachment to bypass Microsoft Defenders SmartScreen prompts when a file is opened. This has been recorded as exploited by financially motivated Water Hydra hacking group.
Adobe
This month, Adobe released fixes for 24 vulnerabilities, of which 5 were rated critical, across Adobe After Effects, 2 critical vulnerabilities impacting Adobe Photoshop, Adobe Commerce and Adobe InDesign, a critical vulnerability impacting Adobe Experience Manager, Adobe Media Encoder, Adobe Bridge and Adobe Illustrator and 2 critical vulnerabilities impacting Adobe Animate. At current, Adobe is not aware of any of these vulnerabilities being actively exploited. The vulnerabilities include Out of Bounds Read, Improper Input Validation, Cross-site Scripting (Stored XSS), Information Exposure and Arbitrary code execution.
SAP
This month, SAP has released 12 patches, which include 10 new releases and 2 updates from previous releases. The vulnerabilities encompass a range of issues, including Security misconfiguration, Information disclosure, Directory traversal, Denial of Service and Missing authorisation checks.
further details on other specific updates within this patch Tuesday can be found here:
https://www.ghacks.net/2024/04/09/microsoft-releases-the-april-2024-security-updates-for-windows/
Further details of the vulnerabilities addressed in Adobe After Effects can be found here: https://helpx.adobe.com/security/products/after_effects/apsb24-09.html
Further details of the vulnerabilities addressed in Adobe Photoshop can be found here:
https://helpx.adobe.com/security/products/photoshop/apsb24-16.html
Further details of the vulnerabilities addressed in Adobe Commerce can be found here: https://helpx.adobe.com/security/products/magento/apsb24-18.html
Further details of the vulnerabilities addressed in Adobe InDesign can be found here:
https://helpx.adobe.com/security/products/indesign/apsb24-20.html
Further details of the vulnerabilities addressed in Adobe Experience Manager can be found here:
https://helpx.adobe.com/security/products/experience-manager/apsb24-21.html
Further details of the vulnerabilities addressed in Adobe Media Encoder can be found here:
https://helpx.adobe.com/security/products/media-encoder/apsb24-23.html
Further details of the vulnerabilities addressed in Adobe Bridge can be found here:
https://helpx.adobe.com/security/products/bridge/apsb24-24.html
Further details of the vulnerabilities addressed in Adobe Illustrator can be found here:
https://helpx.adobe.com/security/products/illustrator/apsb24-25.html
Further details of the vulnerabilities addressed by SAP can be found here:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2024.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
The 31 of March is World Backup Day, Yes, there is a ‘day’ for everything now. Take a few minutes on this one, though
The 31 of March is World Backup Day, Yes, there is a ‘day’ for everything now. Take a few minutes on this one, though.
Making, and safeguarding, a regular backup copy of your systems is an essential part of making your business more resilient when it is attacked. But backups only work if they are done correctly.
The numbers of firms falling victims to attack are rising, with 75% of UK businesses experienced a cyber incident last year, and with ransomware attacks having jumped 73%.
Cyber attackers go for the jugular, by targeting and destroying your backup; this pins you into a corner and forces you to pay a ransom to get your data back since you have no other options. That’s why immutable backups offer a powerful solution: by design, they cannot be altered or deleted by the attacker.
Equally, you need to check that you really can recover your systems from your backup when the time comes. This is not just about recovering one single file that you accidentally deleted; this is about getting enough evidence that you should be able to recover all your priority systems if the worst happens. That assurance comes through testing, and by understanding what the test actually proves.
World Backup Day serves as an annual reminder to perform and test backups, and better protect your data. A key feature is to inform yourself from experts and validate your assumptions. Reach out to us for a free 30-minute consultation to discuss your specific needs and proportionate options.
How to arrange your call:
Visit our website: https://www.blackarrowcyber.com/contact
Include the word “Backup.”
We will get back to you shortly.
Happy World Backup Day
Black Arrow Cyber Advisory 13 March 2024 – Microsoft Patch Tuesday, Adobe, Fortinet and SAP Security Updates Summary
Black Arrow Cyber Advisory 13 March 2024 – Microsoft Patch Tuesday, Adobe, Fortinet and SAP Security Updates
Executive summary
Microsoft’s March Patch Tuesday provides updates to address 60 security issues across its product range. Among the updates provided by Microsoft were 2 critical vulnerabilities allowing remote code execution and denial of service; both of these vulnerabilities relate to Windows Hyper-V. Microsoft’s March 2024 Patch Tuesday has not identified any zero-day vulnerabilities.
In addition to the Microsoft updates this week also saw Adobe, FortiGuard and SAP all provide updates for vulnerabilities in a variety of their products, with multiple rated as critical.
What’s the risk to me or my business?
Successful exploitation of the vulnerabilities could allow an attacker to gain remote code execution, cause a denial of service and impact the confidentiality, integrity and availability of information.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating.
Technical Summary
Microsoft
CVE-2024-21407- This vulnerability if actively exploited, allows a threat actor to gain remote code execution on the host server of a guest virtual machine. It requires an authenticated attacker to send specially crafted file operation requests.
CVE-2024-21408- This vulnerability if actively exploited, allows a threat actor to perform a denial of service. Microsoft have not disclosed how this could be exploited.
Adobe
Adobe have addressed multiple vulnerabilities in its products, including at least 46 in Adobe Experience Manager, 2 critical vulnerabilities in Adobe Premier Pro, a critical vulnerability in Adobe ColdFusion, and 4 vulnerabilities, of which 3 are critical in Adobe Bridge.
Fortinet
Fortinet have released three updates, of which 1 is critical impacting FortiOS and FortiProxy, 1 vulnerability impacting FortiClientEMS, 1 vulnerability impacting FortiWLM MEA for Fortimanager and 1 critical vulnerability in the DAS component.
SAP
This month, SAP has released 12 patches, which include 10 new releases and 2 updates from previous releases. 1 patch and 1 update have been given the “hot news” priority in SAP, the highest severity.. The vulnerabilities encompass a range of issues, including Privilege Escalation, Code Injection, Denial of Service, Information Disclosure, and Improper Authorisation.
further details on other specific updates within this patch Tuesday can be found here:
Further details of the vulnerabilities in Adobe Experience Manager can be found here:
https://helpx.adobe.com/security/products/experience-manager/apsb24-05.html
Further details of the vulnerabilities in Adobe Premier Pro can be found here:
https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html
Further details of the vulnerabilities in Adobe ColdFusion can be found here:
https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html
Further details of the vulnerabilities in Adobe Bridge can be found here:
https://helpx.adobe.com/security/products/bridge/apsb24-15.html
Further details of the vulnerabilities in FortiOS and FortiProxy can be found here:
https://www.fortiguard.com/psirt/FG-IR-23-328
Further details of the vulnerability in FortiClientEMS can be found here:
https://www.fortiguard.com/psirt/FG-IR-23-390
https://www.fortiguard.com/psirt/FG-IR-24-013
Further details of the vulnerability in FortiManager can be found here:
https://www.fortiguard.com/psirt/FG-IR-23-103
Further details of the vulnerability impacting the DAS component can be found here:
https://www.fortiguard.com/psirt/FG-IR-24-007
Further details of the vulnerabilities addressed by SAP can be found here:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/march-2024.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 07 March 2024 – Apple, Cisco and VMware Security Updates
Black Arrow Cyber Advisory 07 March 2024 – Apple, Cisco and VMware Security Updates
Executive Summary
Apple, Cisco and VMware have addressed multiple vulnerabilities across their product range this week, including two actively exploited zero-days affecting Apple products. These vulnerabilities are reportedly being exploited in the wild and have been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerability (KEV) catalog. The seriousness of the VMware vulnerabilities has led to Vmware releasing patches for end-of-life products.
In addition, CISA has issued a warning about a flaw (CVE-2023-21237) impacting Google Pixel phones. Although Google addressed this vulnerability in June 2023, CISA reports that it is still being actively exploited in the wild and has added it to the KEV catalog.
Apple
Apple have released security updates to address several security flaws including two zero-day vulnerabilities that are being actively exploited in the wild and have been added to the (KEV) catalog. This is the third actively exploited zero-day in its software since the start of the year.
What can I do?
Apple have released security patches to address the vulnerabilities and it is advised to update immediately since it has been reported that the vulnerabilities are being exploited in the wild. The vulnerabilities have been addressed in iOS 17.4, iPadOS 17.4, iOS 16.7.6, and iPadOS 16.7.6.
Technical Summary
CVE-2024-23225 – This is a memory corruption issues in the kernel that an attacker with arbitrary kernel read and write capability can exploit to bypass kernel memory protections.
CVE-2024-23296 – This is a memory corruption issue in the RTKit real-time operating system (RTOS) that an attacker with arbitrary kernel read and write can exploit to bypass kernel memory protections.
Cisco
Cisco have addressed two high-severity vulnerabilities in it’s VPN application Secure Client, that could lead to remote exploitation without authentication and execution of code with the highest level of privilege.
What can I do?
Organisations using Secure Client should check if they are running vulnerable versions and apply patches immediately. Where a patch is not available, organisations should follow CISCO’s guidance linked below.
Technical Summary
CVE-2024-20337 - A carriage return line feed injection attack that could be caused remotely, by tricking a user in to clicking a maliciously crafted link. According to CISCO, this only impacts Secure Client instances where the VPN headend is configured with the SAML external browser.
CVE-2024-20338 - A vulnerability that can allow an attacker to execute code with root privileges. This vulnerability only Secure Client for Linux and requires authentication prior to exploitation.
The following versions of Secure Client have been impacted:
CVE-2024-20337
versions 4.10.04065 and later - upgrade to version 4.10.08025
version 5.0 - no patch available and users should migrate to a fixed release
Version 5.1 - should apply the patches in version 5.1.2.42
Versions earlier than Earlier than 4.10.04065 are not vulnerable.
CVE-2024-20338
This impacts Linux versions earlier than 5.1.2.42 and requires authentication for successful exploitation. The first fixed release is version 5.1.2.42.
VMware
VMware have released security patches to address four security flaws impacting ESXi, Workstation and Fusing, two of which are critical flaws (CVE-2024-22252 and CVE-2024-22253) which if exploited could lead to code execution.
What can I do?
VMware have released patches for the impacted products and it is recommended to patch immediately, given the severity of the vulnerabilities. Organisations should also check any end-of-life products they may be using as these have also had patches released.
The following versions have been impacted:
ESXi 6.5 – fixed in 6.5U3v
ESXi 6.7 - fixed in 6.7U3u
ESXi 7.0 - fixed in ESXi70U3p-23307199
ESXi 8.0 - fixed in ESXi80U2sb-23305545 and ESXi80U1d-23299997
VMware Cloud Foundation (VCF) 5.x/4.x – fixed in version KB88287
Workstation 17.x - fixed in 17.5.1
Fusion 13.x (macOS) - fixed in 13.5.1
Technical Summary
CVE-2024-22254 – This is an out-of-bounds write vulnerability in ESXi that a malicious actor with privileges within VMX process could exploit to trigger a sandbox escape.
CVE-2024-22255 – This is an information disclosure vulnerability in the UHCI USB controller that a malicious actor with administrative access to a virtual machine may exploit to leak memory from the VMX process.
Further Information
Apple
Further details on the Apple vulnerabilities can be found here:
https://support.apple.com/en-us/HT214081
Cisco
Further details on the Cisco vulnerabilities can be found here:
CVE-2024-20337 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7
CVE-2024-20338 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds
CISA KEV catalog
Further details of CISA’s KEV catalog can be found here:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
VMware
Further details on the VMware vulnerabilities can be found here:
https://www.vmware.com/security/advisories/VMSA-2024-0006.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 19 February 2024 – Google and Yahoo Change Email Policy Impacting Delivery of Emails from Businesses, What You Need to Know
Black Arrow Cyber Advisory 19 February 2024 – Google and Yahoo Change Email Policy Impacting Delivery of Emails from Businesses, What you Need to Know
Executive summary
Google and Yahoo are tackling spam with their new rules for bulk emails. Gmail and Yahoo have introduced new regulations for bulk email senders, which applies to anyone sending 5,000 or more messages to personal accounts in a 24 hour period. As part of these rules, sending accounts will need to verify themselves, through Domain-based Message Authentication (DMARC).
What’s the risk to me or my business?
Some business unknowingly not be following these rules and as such, their emails will not be hitting the inboxes of customers. Further, this can lead to legitimate businesses being marked as spam from Google.
What can I do?
Businesses who are likely to be considered bulk senders or are currently experiencing issues with their emails should look to follow the guidelines outlined by Google, to make sure they are aligned.
Further details can be found below:
The full list of Google requirements can be found below:
https://support.google.com/a/answer/81126?hl=en
Details on how to add DMARC can be found here:
https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 14 February 2024 – Microsoft Patch Tuesday (inc 2 exploited zero-days), Adobe, and SAP Security Updates
Black Arrow Cyber Advisory 14 February 2024 – Microsoft Patch Tuesday (inc 2 exploited zero-days), Adobe, and SAP Updates Summary
Executive summary
It is Valentine’s, and what better way to spend it than reading about Microsoft’s latest patch Tuesday. In this months patch Tuesday, Microsoft has provided updates to address 73 security issues across its product range, including two exploited zero-day vulnerabilities (CVE-2024-21351and CVE-2024-21412). Microsoft is classifying these as a flaw that is publicly disclosed or actively exploited with no official fix available. The two exploited vulnerabilities affect Windows Smart Screen and Internet Shortcut File, allowing security bypasses. They have both been added to the known ‘exploited vulnerabilities catalog’ by the Cybersecurity and Infrastructure Agency (CISA).
In addition to the updates from Microsoft, this week also saw Adobe fixing 38 vulnerabilities and SAP issued 13 new patches for its range of products, in which three of the patches were rated as critical.
What’s the risk to me or my business?
The vulnerabilities, if actively exploited could allow an attacker to bypass security features and inject malicious code, impacting the confidentiality, integrity and availability of data.
Microsoft
There is no official fix for the exploited vulnerabilities, however they both require a user to interact with a malicious file. As such, it is important to make sure users remain vigilant when interacting with their emails. Organisations should follow the vulnerabilities closely, so that they can apply any patches immediately. Other available updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating. Other patches should be applied in a reasonable time frame.
Technical Summary
CVE-2024-21351: This vulnerability if actively exploited, allows an attacker to bypass Windows SmartScreen. It relies on an authorised attacker sending a malicious file and convincing a user to open it.
CVE-2024-21412: This vulnerability if actively exploited, allows an attacker bypass Windows security features and send malicious files to users. The attacker would still need to user to interact with the file.
Adobe
This month, Adobe has released fixes vulnerabilities impacting Adobe Acrobat and Reader (13, of which 5 are critical), Commerce (9, of which 6 are critical), Substance 3D Painter (13, of which 5 are critical), FrameMaker Publishing Server (1 critical), Audition (1 critical) and Substance 3D Designer (1 critical). Currently, Adobe is not aware of any active exploitation of these vulnerabilities. The vulnerabilities include issues such as arbitrary code execution and memory leaks.
SAP
This month, SAP has released 13 patches, which include 10 new releases and 3 updates from previous releases. These patches address 8 critical vulnerabilities affecting a variety of SAP products. The vulnerabilities encompass a range of issues, including Privilege Escalation, Code Injection, Denial of Service, Information Disclosure, and Improper Authorisation.
Microsoft
Further details on other specific updates within this patch Tuesday can be found here:
https://www.ghacks.net/2024/02/13/the-windows-security-updates-for-february-2024-are-here/
Adobe
Further details of the vulnerabilities addressed in Adobe Acrobat and Reader be found here:
https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
Further details of the vulnerabilities addressed in Adobe Substance 3D Painter be found here:
https://helpx.adobe.com/security/products/substance3d_painter/apsb24-04.html
Further details of the vulnerabilities addressed in Adobe FrameMaker be found here:
https://helpx.adobe.com/security/products/acrobat/apsb24-07.html
Further details of the vulnerabilities addressed in Adobe Audition be found here:
https://helpx.adobe.com/security/products/audition/apsb24-11.html
Further details of the vulnerabilities addressed in Adobe Substance 3D Designer be found here:
https://helpx.adobe.com/security/products/substance3d_designer/apsb24-13.html
SAP
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2024.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity.
Black Arrow Cyber Advisory 12 February 2024 – Fortinet FortiOS Vulnerability in SSL VPN
Black Arrow Cyber Advisory 12 February 2024 – Fortinet FortiOS Vulnerability in SSL VPN
Executive Summary
Fortinet have released a patch to fix a critical vulnerability in their FortiOS product, stating that is potentially being exploited in the wild. Successful exploitation of the vulnerability could allow a remote unauthorised attacker to execute code or commands.
What’s the risk to me or my business?
There is a risk that organisations using vulnerable versions of FortiOS are leaving themselves at risk of allowing an unauthenticated remote attacker to perform arbitrary code execution. This means an attacker could potentially gain unauthorised access and perform actions that could impact the confidentiality, integrity, and availability of the organisations data. This vulnerability only impacts organisations who have SSL VPN enabled.
The affected versions of FortiOS and FortiProxy are:
FortiOS
FortiOS 7.4 (7.4.0 through 7.4.2) – upgrade to 7.4.3 or above.
FortiOS 7.2 (7.2.0 through 7.2.6) – upgrade to 7.2.7 or above.
FortiOS 7.0 (7.0.0 through 7.0.13) – upgrade to 7.0.14 or above.
FortiOS 6.4 (6.4.0 through 6.4.14) – upgrade to 6.4.15 or above.
FortiOS 6.2 (6.2.0 through 6.2.15) – upgrade to 6.4.15 or above.
FortiOS 6.0 (all versions) - migrate to fixed release.
FortiProxy
FortiProxy 7.4 (7.4.0 through 7.4.2) - upgrade to 7.4.3 or above.
FortiProxy 7.2 (7.2.0 through 7.2.8) - upgrade to 7.2.9 or above.
FortiProxy 7.0 (7.0.0 through 7.0.14) - upgrade to 7.0.15 or above.
FortiProxy 2.0 (2.0.0 through 2.0.13) - upgrade to 2.0.14 or above.
FortiProxy 1.2 (all versions) - migrate to fixed release.
FortiProxy 1.1 (all versions) - migrate to fixed release.
FortiProxy 1.0 (all versions) - migrate to fixed release.
What can I do?
Black Arrow recommends applying the available patches for the vulnerability immediately due its severity. Further information can be found in the Fortigaurd security update below. Organisations have also been advised to disable SSL VPN if they cannot apply patches immediately, however this is not a long term solution.
Technical Summary
CVE-2024-2176 – This is a out-of-bound write vulnerability in the sslvpnd which may allow a remote unauthenticated attacker to execute arbitrary code or commands using specifically crafted HTTP requests.
Further information on the FortiOS vulnerability can be found here:
https://www.fortiguard.com/psirt/FG-IR-24-015
Further information on upgrading can be found here:
https://docs.fortinet.com/upgrade-tool
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 09 February 2024 – Cisco, Fortinet, Ivanti and VMware Security Updates
Black Arrow Cyber Advisory 09 February 2024 – Cisco, Fortinet, Ivanti and VMware Security Updates
Executive Summary
Cisco, Fortinet, Ivanti and VMware have addressed multiple vulnerabilities across their product range. All of the vendors have a security patch available to address the vulnerabilities and due to the active exploitation of some of the vulnerabilities, it is recommended to apply them immediately.
Cisco
Cisco have released security updates for three flaws affecting the Cisco Expressway Series that could allow an unauthenticated remote attacker to conduct cross-site request forgery attacks. Two of the flaws are rated critical (CVE-2024-20252 and CVE-2024-20254) and can be exploited in the impacted devices default configuration, however the third flaw (CVE-2024-20255) can only be exploited if the cluster database API feature has been enabled, which is disabled by default.
Cisco have released patches for the affected products and are available in Cisco Expressway Series Release versions 14.3.4 and 15.0.0.
Fortinet
Fortinet have released a second round of updates addressing two previously disclosed critical flaws in the FortiSIEM supervisor. The two flaws (CVE-2024-23108 and CVE-02024-23109) allows a remote unauthenticated attacker to perform arbitrary code execution.
Impacted products are:
FortiSIEM version 7.1.0 through 7.1.1 fixed in 7.1.2
FortiSIEM version 7.0.0 through 7.0.2 fixed in 7.0.3
FortiSIEM version 6.7.0 through 6.7.8 fixed in 6.7.9
FortiSIEM version 6.6.0 through 6.6.3 fixed in 6.6.5
FortiSIEM version 6.5.0 through 6.5.2 fixed in 6.5.3
FortiSIEM version 6.4.0 through 6.4.2 fixed in 6.4.4
Ivanti
Another critical security patch has been released by Ivanti for their Connect Secure product, Policy Secure and ZTA gateways. The flaw (CVE-2024-22024) allows remote attackers to gain access to restricted resources without requiring user interaction or authentication. While Ivanti have stated that this vulnerability is not currently being actively exploited they urge affected users to patch immediately.
To mitigate the risks, it is recommended that all users of the impacted devices running version 6.x upgrade to version 6.12.0.
VMware
VMware have warned of five vulnerabilities in the Aria Operations for Networks. The vulnerabilities encompass a range of issues, including local privilege escalation, cross-site scripting and local file read (requires admin privileges).
To mitigate the risks, it is recommended that all users of the impacted devices running version 6.x upgrade to version 6.12.0
Further Information
Cisco
Further details on the Cisco vulnerabilities can be found here:
Fortinet
Further details on the Fortinet vulnerabilities can be found here:
https://www.fortiguard.com/psirt/FG-IR-23-130
Ivanti
Further details on the Ivanti vulnerabilities can be found here:
VMware
Further details on the VMware vulnerabilities can be found here:
https://kb.vmware.com/s/article/96450
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 23 January 2024 – Apple, Atlassian, Ivanti and VMware Vulnerabilities Under Active Exploitation
Black Arrow Cyber Advisory 23 January 2024 – Apple, Atlassian, Ivanti and VMware Security Updates
Executive Summary
Vulnerabilities in Apple, Atlassian, Ivanti and VMware are currently being actively exploited in the wild. All of the vendors have a security patch available to address the vulnerabilities and due to the active exploitation of the vulnerabilities, it is recommended to apply them immediately.
Apple
Following a report that Chinese authorities revealed they have used previously known vulnerabilities in Apple's AirDrop functionality to help law enforcement, Apple have released a patch for an actively exploited critical Zero-day in iOS, iPadOS, macOS, tvOS and Safari web browser,. The zero-day vulnerability is a type confusion exploit that allows an attacker to perform arbitrary code execution.
Impacted Versions:
iOS 17.3 and iPadOS 17.3 - iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later
iOS 16.7.5 and iPadOS 16.7.5 - iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation
macOS Sonoma 14.3 - Macs running macOS Sonoma
macOS Ventura 13.6.4 - Macs running macOS Ventura
macOS Monterey 12.7.3 - Macs running macOS Monterey
Safari 17.3 - Macs running macOS Monterey and macOS Ventura
What can I do?
Updates to vulnerable devices should be applied immediately due to this vulnerability being under active exploitation.
Atlassian
Following the disclosure of the Atlassian Confluence vulnerability, it has become a target for active exploitation. Researchers have observed attackers attempting to exploit this vulnerability. At present, there are 11,000 Confluence instances exposed on the internet, and Shadowserver has recorded nearly 40,000 exploitation attempts. For further information on the vulnerability see our advisory posted linked below.
Ivanti
Following the public disclosure of two Ivanti vulnerabilities being actively exploited, a third vulnerability has now been added to the CISA’s Known Exploited Vulnerabilities (KEV) Catalog.
CVE-2023-35082 - This vulnerability enables a remote unauthorised attacker to access users’ personally identifiable information and make limited modifications to the server.
Impacted versions:
his vulnerability impacts all versions of Ivanti Endpoint Manager Mobile (EPMM) 11.10, 11.9, and 11.8. MobileIron Core 11.7 and earlier versions are also affected by this vulnerability.
What can I do?
Ivanti released a patch for this vulnerability in August 2023. It is recommended to update any impacted products to version 11.11.0.0 or later to safeguard them from this vulnerability.
VMware
A critical vulnerability in VMware vCenter Server Management has been exploited in the wild by a Chinese hacking group since 2021. The vulnerability (CVE-2023-34048) allows an attacker to write out of bounds potentially leading to remote code execution. VMware released a patch in October 2023 stating that it was not under active exploitation. VMware have recommend customers update to the latest version, which is 9.0U2.
Further Information
For further information on Ivanti and Atlassian see our previous advisory:
Apple
Further details on the Apple vulnerabilities can be found here:
https://support.apple.com/en-gb/HT201222
Ivanti
Further details on the Ivanti vulnerabilities can be found here:
VMware
Further details on the VMware vCenter Server Management vulnerability can be found here:
https://www.vmware.com/security/advisories/VMSA-2023-0023.html
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 17 January 2024 – Citrix and Ivanti Vulnerabilities Under Active Exploitation - Atlassian, Oracle, SonicWall, and VMware also Address Security Flaws
Black Arrow Cyber Advisory 17 January 2024 – Citrix and Ivanti Vulnerabilities Under Active Exploitation - Atlassian, Oracle, SonicWall, and VMware Also Address Security Flaws
This week Atlassian, Citrix, Ivanti, Oracle, SonicWall and VMware have addressed multiple vulnerabilities across their product range. Included in the vulnerabilities addressed are two actively exploited 0-days, impacting Ivanti and Citrix products. At the time of writing, over 1700 Ivanti devices have been compromised and over 15,000 devices remain exposed.
Executive Summary
This week Atlassian, Citrix, Ivanti, Oracle, SonicWall and VMware have addressed multiple vulnerabilities across their product range. Included in the vulnerabilities addressed are two actively exploited 0-days, impacting Ivanti and Citrix products. At the time of writing, over 1700 Ivanti devices have been compromised and over 15,000 devices remain exposed.
Atlassian
CVE-2023-22527 - This exploit is a template injection vulnerability which if successfully exploited, allows an unauthenticated attacker to perform remote code execution on an affected instance.
Impacted Versions:
This vulnerability affects versions 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0-8.5.3.
What can I do?
Atlassian has released patches for the affected products, and it is advised to patch immediately. The listed Fixed Versions are no longer the most up-to-date and do not protect your instance from other non-critical vulnerabilities as outlined in Atlassian’s January Security Bulletin.
Citrix NetScaler
CVE-2023-6548 – Allows authenticated (low privileged user) remote code execution on Management interface. Requires access to NSIP, CLIP or SNIP with management interface.
CVE-2023-6549 - If exploited allows an attacker to perform a denial of service attack. Appliance must be configured as a gateway or AAA virtual server.
Impacted Versions:
NetScaler ADC and NetScaler Gateway 14.1 before 14.1-12.35
NetScaler ADC and NetScaler Gateway 13.1 before 13.1-51.15
NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.21
NetScaler ADC 13.1-FIPS before 13.1-37.176
NetScaler ADC 12.1-FIPS before 12.1-55.302
NetScaler ADC 12.1-NDcPP before 12.1-55.302
NetScaler ADC and NetScaler Gateway version 12.1 (currently end-of-life)
What can I do?
Citrix have released patches for the impacted products. Citrix have reported that this is being actively exploited and seen in the wild so it is advised that the patches are applied immediately.
Ivanti
CVE-2023-46805 - This is an authentication bypass which enables an attacker to access restricted resources by circumventing control checks.
CVE-2024-21887 - This is a command injection that lets authenticated admins execute arbitrary commands on vulnerable appliances.
Impacted Versions:
These vulnerabilities impact all supported versions, 9.x and 22.x
What can I do?
Ivanti have released mitigation files which can be found below, it is advised to install immediately. Patches are being developed however they are being staggered with the first patches being released on January 22nd and the final patches released on February the 19th.
Oracle
In their first Critical Patch Update of 2024, Oracle hae released 389 security patches, addressing 200 vulnerabilities. Financial Services Applications were the most impacted, with 71 new security patches. Oracle have urged all customers to apply the patches as soon as possible, warning that it periodically receives reports of in-the-wild exploitation of issues for which it has released fixes.
SonicWall
CVE-2022-22274 - This is a buffer overflow which if exploited successfully allows a remote unauthenticated attacker to cause a denial of service or potentially result in a code execution in the firewall.
CVE-2023-0656 - This is a buffer overflow which if exploited successfully allows a remote unauthenticated attacker to cause a denial of service attack which could cause the impacted firewall to crash.
What can I do?
SonicWall have released patches for affected products and it is advised to update to the latest available version.
VMware
CVE-2023-34063 – The affected products contain a missing access control vulnerability, which if successfully exploited, this vulnerability may lead to unauthorised access to remote organisations and workflows.
VMware Aria Automation (8.11.x, 8.12.x, 8.13.x, and 8.14.x)
VMware Cloud Foundation (4.x and 5.x)
What can I do?
VMware have released patches which can be found in the Security Advisory. It is advised to update as soon as possible. There are no current workarounds.
Further Information
Atlassian
Further details on the Atlassian vulnerabilities can be found here:
https://confluence.atlassian.com/security/security-bulletin-january-16-2024-1333335615.html
Citrix NetScaler
Further details on the Citrix NetScaler vulnerabilities can be found here:
Ivanti
Further details on the Ivanti vulnerabilities can be found here:
Oracle
Further details on the Oracle vulnerabilities can be found here:
https://www.oracle.com/security-alerts/cpujan2024.html
SonicWall
Further details on the SonicWall vulnerabilities can be found here:
https://bishopfox.com/blog/its-2024-and-over-178-000-sonicwall-firewalls-are-publicly-exploitable
VMware
Further details on the VMware vulnerability can be found here:
https://www.vmware.com/security/advisories/VMSA-2024-0001.html
https://core.vmware.com/resource/vmsa-2024-0001-questions-answers
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 11 January 2024 – Microsoft Patch Tuesday, Adobe, Android, Cisco, and SAP Updates
Black Arrow Cyber Advisory 11 January 2024 – Microsoft Patch Tuesday, Adobe, Cisco, SAP and Google Android Updates
Executive summary
In its first Patch Tuesday of 2024, Microsoft has provided updates to address 49 security issues across its product range, including two critical vulnerabilities (CVE-2024-20700 and CVE-2024-20674). None of these vulnerabilities are listed as publicly known or under active exploitation. The two critical vulnerabilities affect Hyper-V, allowing remote code execution, and Kerberos, enabling attackers to bypass security features.
In addition to the updates from Microsoft, this week also saw Adobe fixing 6 vulnerabilities, Cisco patching 2 vulnerabilities, and Android addressing 59 vulnerabilities, none of which were critical. SAP also issued 12 new patches for its range of products, three of the patches were rated as critical.
What’s the risk to me or my business?
The vulnerabilities, if actively exploited could allow an attacker to perform remote code execution, the other vulnerability allows an attacker to perform a man in the middle attack and send a malicious message to impersonate themselves as the Kerberos authentication server, bypassing security features.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the critical vulnerabilities. Other patches should be applied in a reasonable time frame.
Technical Summary
CVE-2024-20700: This vulnerability if actively exploited, allows an attacker to impersonate the Kerberos authentication server and bypass security features.
CVE -2024-20674: This vulnerability if actively exploited, allows an attacker to perform remote code execution. Successful exploitation requires an attacker to gain access to the restricted network before running an attack.
Adobe
This month, Adobe has released fixes for six vulnerabilities that affect Adobe Substance 3D Stage 2.1.3 and earlier versions. None of these vulnerabilities were rated as critical. Currently, Adobe is not aware of any active exploitation of these vulnerabilities. The vulnerabilities include issues such as arbitrary code execution and memory leaks.
Android
In Google’s January Security Bulletin for Android, 59 vulnerabilities are addressed, including three that are critical in the Qualcomm section. None of these vulnerabilities appear to have been discovered and exploited by criminals prior to the release of the patches. The vulnerabilities include issues such as elevation of privileges and information disclosure.
Cisco
Cisco has released an update to address two privilege escalation CVEs in its Identity Services Engine (ISE). These vulnerabilities, which were disclosed in September, necessitate administrator-level privileges for exploitation. At present, Cisco has provided patches to rectify these issues, and no other workaround is available.
SAP
This month, SAP has released 12 patches, which include 10 new releases and 2 updates from previous releases. These patches address 3 critical vulnerabilities affecting a variety of SAP products. The vulnerabilities encompass a range of issues, including Privilege Escalation, Code Injection, Denial of Service, Information Disclosure, and Improper Authorisation.
Microsoft
Further details on other specific updates within this patch Tuesday can be found here:
https://www.theregister.com/2024/01/09/january_patch_tuesday/
https://www.ghacks.net/2024/01/09/the-first-windows-security-updates-of-2024-are-here/
Adobe
Further details of the vulnerabilities addressed in Adobe Substance 3D Stager be found here: https://helpx.adobe.com/security/products/substance3d_stager/apsb24-06.html
Android
Further details on the Android patches can be found here:
https://source.android.com/docs/security/bulletin/2024-01-01
Cisco
Further details on the Cisco patch can be found here:
SAP
Further information of the vulnerabilities address by SAP can be found here:
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 14 December 2023 – Microsoft Patch Tuesday, Adobe and SAP Security Updates
Black Arrow Cyber Advisory 14 December 2023 – Microsoft Patch Tuesday, Adobe and SAP Security Updates
Executive summary
Microsoft’s December Patch Tuesday provides updates to address 36 security issues across its product range, including 4 critical vulnerabilities and 1 zero-day. The zero-day, which impacts AMD processors, was originally disclosed in August 2023 with no patches provided by AMD.
In addition to the Microsoft updates this week, Adobe and SAP fixed multiple vulnerabilities across their product range.
What’s the risk to me or my business?
The vulnerabilities, if actively exploited, can allow an attacker to escalate privileges, remotely execute code, cause sensitive data leaks and cause a denial of service. All of which can result in an impact to the confidentiality, integrity and availability of data in your organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the vulnerabilities that have a critical severity rating. Other patches should be applied in a reasonable time frame.
Technical Summary
Microsoft
CVE-2023-20588: A vulnerability in AMD processors that could potentially return speculative and sensitive data if exploirted.
CVE-2023-36019- A vulnerability in Microsoft Power Platform and Azure Logic Apps that allows spoofing.
CVE-2023-35630- A vulnerability in Internet Connection Sharing that if exploited, allows remote code execution.
CVE-2023-35628- A vulnerability in Internet Connection Sharing that if exploited, allows remote code execution.
CVE-2023-35641- A Remote Code Execution Vulnerability in Windows MSHTML, which is used for Internet Explorer.
Adobe
This month, Adobe released fixes for 212 vulnerabilities, of which 13 were rated critical, across Adobe Illustrator (3), Substance3D Sampler (6), After Effects (3) and Designer (1). The critical vulnerabilities include arbitrary code execution and memory leak.
SAP
Enterprise software vendor SAP has addressed 17 vulnerabilities, including 4 critical, in several of its products.
Microsoft
Further details on other specific updates within this patch Tuesday can be found here:
Adobe
Further details of the vulnerabilities addressed in Adobe Illustrator can be found here:
https://helpx.adobe.com/security/products/illustrator/apsb23-68.html
Further details of the vulnerabilities addressed in Adobe Substance3D Sampler can be found here:
https://helpx.adobe.com/security/products/substance3d-sampler/apsb23-74.html
Further details of the vulnerabilities addressed in Adobe Substance3D After Effects can be found here:
https://helpx.adobe.com/security/products/after_effects/apsb23-75.html
Further details of the vulnerabilities addressed in Adobe Substance3D Designer can be found here:
https://helpx.adobe.com/security/products/substance3d_designer/apsb23-76.html
SAP
Further information of the vulnerabilities address by SAP can be found here:
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 04 December 2023 – Apple, Google, ownCloud, Zoom and Zyxel Vulnerabilities Summary
Black Arrow Cyber Advisory 04 December 2023 – Apple, Google, ownCloud, Zoom and Zyxel Vulnerabilities Summary
Executive summary
Apple, Google, ownCloud and Zoom have all addressed vulnerabilities in their products which could be exploited by an attacker. The vulnerabilities could lead to remote code execution. The vulnerabilities impacting Google and ownCloud are actively being exploited by malicious actors.
Apple
Two new Zero-Days impacting Apples WebKit Browser were fixed in emergency updates. The two vulnerabilities allow attackers to gain access to sensitive information via an out-of-bounds read weakness and gain arbitrary code execution via maliciously crafted webpages.
Google Chrome
Google has addressed several vulnerabilities, including one actively exploited zero-day. The actively exploited zero-day is caused by a weakness within the Skia open-source 2D graphics library and can lead to remote execution. The vulnerability has been recorded as actively exploited.
ownCloud
Three vulnerabilities in the open-source file sharing software, ownCloud could disclose sensitive information and allow an attacker to modify files, if exploited. As a fix, ownCloud is recommending to delete the "owncloud/apps/graphapi/vendor/microsoft/microsoft-graph/tests/GetPhpInfo.php" file and disable the 'phpinfo' function. It is also advising users to change secrets like the ownCloud admin password, mail server and database credentials, and Object-Store/S3 access keys. One of the vulnerabilities has already been recorded as being actively exploited by malicious actors
Zoom
A vulnerability in Zoom could allow threat actors to take over meetings and steal data has been patched. Research has stated that the flaw was first discovered in June 2023. There are no reports of active exploitation in the wild at this time.
Zyxel
Zyxel have documented multiple security flaws in a range of products, including firewalls, access points and network attached storage (NAS) Devices, warning that unpatched devices are at risk of authentication bypass, command injection and denial-of-service attacks.
What’s the risk to me or my business?
There is a risk that that running unpatched versions of the above products will leave users at open to having the confidentiality, integrity and availability of their information compromised.
What can I do?
Black Arrow recommends organisations check whether they are running vulnerable versions of the above products, and if so, these should be updated to patched versions. Further information can be found below.
Further information about the Apple vulnerabilities can be found here:
https://www.bleepingcomputer.com/news/apple/apple-fixes-two-new-ios-zero-days-in-emergency-updates/
https://support.apple.com/en-gb/HT214031
https://support.apple.com/en-gb/HT214033
further information about the Google vulnerabilities can be found here:
https://thehackernews.com/2023/11/zero-day-alert-google-chrome-under.html
https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html
Further information about the ownCloud vulnerabilities can be found here:
https://thehackernews.com/2023/11/warning-3-critical-vulnerabilities.html
https://owncloud.com/security-advisories/subdomain-validation-bypass/
https://owncloud.com/security-advisories/webdav-api-authentication-bypass-using-pre-signed-urls/
Further information about the Zoom vulnerabilities can be found here:
https://www.hackread.com/zoom-vulnerability-hackers-hijack-meetings-data/
Further information about the Zyxel vulnerabilities can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity