Week in review

AUSCERT Week in Review for 9th August 2024

Greetings, We continuously strive to help our members minimize their exposure to cyber threats and understand that effective prioritisation in vulnerability management is a growing concern. To assist with these efforts, AUSCERT is pleased to introduce the Exploitation Prediction Scoring System (EPSS) within our bulletins and Critical MSINs, starting August 12, 2024. Read our blog article for more information!. This week, CrowdStrike published a root cause analysis of the recent widespread outage caused by a faulty update pushed out to its Falcon customers. The report details the chain of events and multiple independent testing failures that occurred during the creation and validation of the problematic configuration file distributed to customers. After such a widespread outage causing billions of dollars in damage across multiple countries, many are questioning who is legally responsible. Microsoft, whose ecosystem was impacted, estimated the outage affected 8.5 million Windows devices. Some organisations that were significantly affected by the incident have begun seeking legal recourse against CrowdStrike for compensation for the disruption to business. Delta Air Lines, which suffered widespread flight disruptions and service failures, is seeking financial damages against CrowdStrike. The outages cost Delta an estimated US$350 million to $500 million, as they are dealing with over 176,000 refund or reimbursement requests after almost 7,000 flights were cancelled. However, CrowdStrike has rejected allegations of gross negligence or misconduct, arguing that the terms and conditions of their contracts may limit their liability to customers, thereby severely restricting options for seeking redress under contract law. This has led some law firms to explore the possibility of pursuing class action under other claims, such as negligence. This case reveals the vulnerability of global supply chains and the significant impact IT disruptions can have on organisations worldwide. Major insurance companies are closely monitoring the situation, and many businesses are now scrutinizing their cyber insurance policies. This incident has prompted many to consider whether additional legal ramifications should be established to better protect consumers and hold responsible parties more accountable for their actions. Critical Kibana Vulnerability Let Attackers Execute Arbitrary Code Date: 2024-08-07 Author: Cyber Security News [AUSCERT has identified the impacted members (where possible) and contacted them via email] Kibana, a popular open-source data visualization and exploration tool, has identified a critical security flaw that could allow attackers to execute arbitrary code. This vulnerability, tracked as CVE-2024-37287, has a CVSSv3 severity rating of 9.9, indicating its critical nature. The flaw arises from a prototype pollution vulnerability that can be exploited by attackers with access to Machine Learning (ML) and Alerting connector features and write access to internal ML indices. Exploiting this vulnerability allows attackers to execute arbitrary code, posing significant security risks, as reported by Elastic Cloud. Chrome, Firefox Updates Patch Serious Vulnerabilities Date: 2024-08-07 Author: Security Week [Please also see AUSCERT's bulletins: https://portal.auscert.org.au/bulletins/ESB-2024.5054/ & https://portal.auscert.org.au/bulletins/ESB-2024.5049/] Mozilla and Google both updated their web browsers on Tuesday and the latest versions patch several potentially serious vulnerabilities. Google updated Chrome to version 127.0.6533.99, which fixes six vulnerabilities, including a critical out-of-bounds memory access issue in the Angle component. A reward has yet to be determined for this flaw, which is tracked as CVE-2024-7532. Critical 1Password Security Flaw Could Let Hackers Steal Unlock Key Date: 2024-08-07 Author: Forbes AgileBits, the developer of the hugely popular 1Password password manager, has confirmed that a critical security vulnerability could have allowed an attacker to exfiltrate password vault items and potentially obtain account unlock keys from macOS users. What Is CVE-2024-42219? In a 1Password support posting it was stated that CVE-2024-42219 could enable a “malicious process running locally on a machine to bypass inter-process communication protections” and allow the malicious software in question to “exfiltrate vault items, as well as obtain derived values used to sign in to 1Password, specifically the account unlock key and SRP-𝑥.” Security Bypass Vulnerability Found in Rockwell Automation Logix Controllers Date: 2024-08-02 Author: Security Week [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4972/] Organizations using certain Logix programmable logic controllers (PLCs) made by Rockwell Automation have been informed about a high-severity security bypass vulnerability discovered by researchers at industrial cybersecurity firm Claroty. On August 1, Claroty published a blog post describing its findings, and Rockwell and the cybersecurity agency CISA published advisories for the flaw, which is tracked as CVE-2024-6242. Google fixes Android kernel zero-day exploited in targeted attacks Date: 2024-08-07 Author: Bleeping Computer [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.5013] Android security updates this month patch 46 vulnerabilities, including a high-severity remote code execution (RCE) exploited in targeted attacks. The zero-day, tracked as CVE-2024-36971, is a use after free (UAF) weakness in the Linux kernel's network route management. It requires System execution privileges for successful exploitation and allows altering the behavior of certain network connections. Roundcube Webmail Flaws Allow Hackers to Steal Emails and Passwords Date: 2024-08-07 Author: The Hacker News [AUSCERT has identified the impacted members (where possible) and contacted them via email] Cybersecurity researchers have disclosed details of security flaws in the Roundcube webmail software that could be exploited to execute malicious JavaScript in a victim's web browser and steal sensitive information from their account under specific circumstances. "When a victim views a malicious email in Roundcube sent by an attacker, the attacker can execute arbitrary JavaScript in the victim's browser," cybersecurity company Sonar said in an analysis published this week. CrowdStrike Releases Root Cause Analysis of Falcon Sensor BSOD Crash Date: 2024-08-06 Author: Security Week Embattled cybersecurity vendor CrowdStrike on Tuesday released a root cause analysis detailing the technical mishap behind a software update crash that crippled Windows systems globally and blamed the incident on a confluence of security vulnerabilities and process gaps. The new CrowdStrike root cause analysis documents a combination of factors the Falcon EDR sensor crash — a mismatch between inputs validated by a Content Validator and those provided to a Content Interpreter, an out-of-bounds read issue in the Content Interpreter, and the absence of a specific test — and a vow to work with Microsoft on secure and reliable access to the Windows kernel. ESB-2024.4645.2 – Cisco Smart Software Manager On-Prem (SSM On-Prem): CVSS (Max): 10.0 The Cisco PSIRT has updated its initial advisory from July 2027 to confirm that proof-of-concept exploit code is now available for the vulnerability discussed in the advisory. However, they have not reported any instances of malicious exploitation related to this vulnerability. AUSCERT advises its members to apply the patches immediately if they haven't already done so, to prevent potential exploitation. ESB-2024.5095 – Jenkins (core):CVSS (Max): 9.0 The Jenkins Security Advisory 2024-08-07 addresses critical vulnerabilities in Jenkins core that could lead to arbitrary file read and potential remote code execution (CVE-2024-43044). It also highlights a medium-severity issue allowing unauthorized access to other users' "My Views" (CVE-2024-43045). Updates in Jenkins versions 2.471 and LTS 2.452.4 resolve these vulnerabilities. ASB-2024.0160 – EPSS Score Starting August 12, 2024, AUSCERT will include Exploitation Prediction Scoring System (EPSS) scores in Bulletins and Critical MSINs to indicate the likelihood of vulnerability exploitation. The EPSS score will be displayed alongside the CVSS score for Bulletins and in the Overview of Critical MSINs. Members should use up-to-date EPSS values for informed vulnerability management. ESB-2024.5054 – Google Chrome: CVSS (Max): 8.8* On August 6, 2024, Chrome’s Stable channel updated to version 127.0.6533.99 for Windows, Mac, and Linux, introducing five security fixes. Notable fixes include critical and high-severity vulnerabilities reported by external researchers, such as out-of-bounds memory access and use-after-free issues. ESB-2024.5049 – Firefox: CVSS (Max): 9.8* Mozilla's Security Advisory 2024-33, released August 6, 2024, addresses high-impact vulnerabilities in Firefox 129. Key issues include CVE-2024-7518, which allows fullscreen dialogs to be obscured, and CVE-2024-7519, involving out-of-bounds memory access in graphics handling. Other critical fixes cover type confusion in WebAssembly and various use-after-free vulnerabilities. ESB-2024.5013 – Android: CVSS (Max): 9.8* The August 2024 Android Security Bulletin addresses high-severity vulnerabilities affecting Android devices, including critical privilege escalation issues in the Framework component. The patch levels of 2024-08-05 or later resolve these issues. Updates are available in the AOSP repository , with Android partners notified in advance. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 2nd August 2024

Greetings, With the Olympic Games in full swing, many of us are thrilled to cheer on our country in every sport, celebrating the incredible athletic talents of all participants. Each event showcases the dedication, skill, and fairness of athletes from around the world, inspiring us with their remarkable performances and unwavering determination. It is a privilege to witness this global celebration of excellence and unity through sport. Security2Cure is back, bigger and better than ever! This year, the event will be held in Brisbane on August 9th and in Sydney on August 23rd. The event will bring more stories of survival, grief, resilience, and love from within our amazing cyber industry, and we welcome everyone to be part of this inspiring experience. Now in its fourth year, Security2Cure raises money for cancer research, support, and prevention. The day's schedule in both cities includes a range of engaging talks on various aspects of cyber security, covering both technical and non-technical topics. Places are limited! Don’t miss the opportunity to hear from industry peers, leaders, and enthusiasts as they share insights from the cyber front lines and embrace the humility and vulnerability surrounding a disease that affects us all. Support a worthy cause and be inspired by the stories of strength and determination from within our community. If you can’t attend you can still donate to this great cause, just head to the website! Apple Rolls Out Security Updates for iOS, macOS Date: 2024-07-30 Author: Security Week [Please also see AUSCERT bulletins: https://portal.auscert.org.au/bulletins/ESB-2024.4910/, https://portal.auscert.org.au/bulletins/ESB-2024.4911/, https://portal.auscert.org.au/bulletins/ESB-2024.4912/, https://portal.auscert.org.au/bulletins/ESB-2024.4913/, https://portal.auscert.org.au/bulletins/ESB-2024.4914/, https://portal.auscert.org.au/bulletins/ESB-2024.4915/, https://portal.auscert.org.au/bulletins/ESB-2024.4916/, https://portal.auscert.org.au/bulletins/ESB-2024.4917/, https://portal.auscert.org.au/bulletins/ESB-2024.4918/] iOS 17.6 and iPadOS 17.6 were released for the latest generation iPhone and iPad devices with fixes for 35 security defects that could lead to authentication and policy bypasses, unexpected application termination or system shutdown, information disclosure, denial-of-service (DoS), and memory leaks. Microsoft confirms Azure, 365 outage linked to DDoS attack Date: 2024-07-31 Author: Cyber Security Dive Dive Brief: Microsoft said a DDoS attack led to an eight hour outage Tuesday involving its Azure portal, as well as some Microsoft 365 and Microsoft Purview services. Microsoft said an unexpected spike in usage led to intermittent errors, spikes and timeouts in Azure Front Door and Azure Content Delivery Network. An initial investigation showed an error in the company’s security response may have compounded the impact of the outage. Microsoft said it will have a preliminary review of the incident in 72 hours and a final review within two weeks, to see what went wrong and how to better respond. Google Releases Critical Security Update for Chrome Date: 2024-07-31 Author: Cyber Security News [Please see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4872/] Google has rolled out a critical security update for its Chrome browser, addressing a severe flaw that could lead to browser crashes. The update, now available on the Stable channel, brings Chrome to version 127.0.6533.88/89 for Windows and Mac and 127.0.6533.88 for Linux. This update will be distributed over the coming days and weeks. The latest update includes three significant security fixes, two of which were reported by an external researcher known as “gelatin dessert.” The details of these fixes are as follows: Cyber ransom payments will need to be disclosed by businesses under new laws Date: 2024-07-30 Author: ABC News Australian businesses are paying untold amounts of ransom to hackers, but the government is hoping to claw back some visibility with a landmark cybersecurity law. The Cyber Security Act would force Australian businesses and government entities to disclose payments or face fines, and is expected to be brought before parliament in the next sitting. Dark Angels ransomware receives record-breaking $75 million ransom Date: 2024-07-30 Author: Bleeping Computer A Fortune 50 company paid a record-breaking $75 million ransom payment to the Dark Angels ransomware gang, according to a report by Zscaler ThreatLabz. "In early 2024, ThreatLabz uncovered a victim who paid Dark Angels $75 million, higher than any publicly known amount— an achievement that's bound to attract the interest of other attackers looking to replicate such success by adopting their key tactics (which we describe below)," reads the 2024 Zscaler Ransomware Report. Gov revamps cyber security leadership in ministerial shake-up Date: 2024-07-28 Author: iTnews The federal government has named Tony Burke as its new minister for cyber security as well as Home Affairs, with incumbent Clare O’Neil moved to the housing portfolio. Albanese also announced a new advisory role for MP Andrew Charlton, as “special envoy for cyber security and digital resilience”. ESB-2024.4872 – Google Chrome: CVSS (Max): None Google has released an urgent security update for its popular Chrome browser to address three vulnerabilities, including one classified as "critical." These vulnerabilities, identified as CVE-2024-6990, CVE-2024-7255, and CVE-2024-7256, could potentially enable attackers to exploit flaws in the browser, putting user security at risk. ESB-2024.4948 – Apache Commons Collections: CVSS (Max): 9.8 Apache Commons Collections could be made to execute arbitrary code if it received specially crafted input. The problem can be corrected by updating your system to libcommons-collections3-java – 3.2.1-6ubuntu0.1~esm1 available with Ubuntu Pro ESB-2024.4912 – Apple iOS and iPad OS: CVSS (Max): 7.5* Apple has released iOS and iPad OS patches to address vulnerabilities such as a maliciously crafted file potentially leading to unexpected app termination plus various bug fixes and enhancements. ESB-2024.4973 – Vonets WiFi Bridges: CVSS (Max): 10.0 Vulnerabilities were identified that could allow an attacker to disclose sensitive information, cause a denial of service condition or execute arbitrary code on affected devices. Vonets has not responded to requests by CISA to mitigate this vulnerability. CISA recommended users take defensive measures to minimize the risk of exploitation of these vulnerabilities. ESB-2024.4960 – IBM QRadar SIEM: CVSS (Max): 9.8 IBM QRadar SIEM includes vulnerable components (e.g., framework libraries) that could be identified and exploited with automated tools. These have been addressed in the update. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 26th July 2024

Greetings, Friday afternoon, CrowdStrike released a sensor configuration update that triggered errors and system crashes in millions of Windows systems, causing major outages worldwide. This event grounded flights, disrupted banks, and closed businesses, highlighting the interconnectedness and fragility of our digital infrastructure. It served as a wake-up call, emphasising that the IT industry is a critical component linking every part of the world. When mistakes are made or incidents occur, the repercussions are felt globally. Reports indicate that malicious actors are quickly capitalising on the disruption caused by this technical issue. Cyber criminals are exploiting the outage window to launch phishing campaigns and other malicious activities. Notably, there have been reports of criminals mimicking CrowdStrike support communications and even impersonating CrowdStrike staff during phone calls.CrowdStrike has also noted instances where cyber criminals posed as independent researchers, falsely asserting evidence linking the technical issue to a cyber attack. In response to these developments, cyber security organisations and authorities have issued advisories urging heightened vigilance. Users are encouraged to verify the authenticity of communications, especially during service disruptions, and to adhere strictly to official channels for updates and support. For more information regarding this issue,read our full article here Attention Brisbane Members! In partnership with WTW and Ethan Global, we will be hosting an event in the CBD on August 13th for IT Directors, Managers, CISOs, C-Suite executives, as well as Risk and Insurance Managers. During this in-person session, AUSCERT, WTW, and Ethan Global will provide attendees with insights and practical steps to understand and communicate holistic cyber risk management strategies, drawn from real-life case studies.Our speakers will examine developments in legal and regulatory changes, prioritising cyber investments, and reporting. Don't miss this opportunity to hear firsthand from thought leaders and experienced practitioners through both presentations and panel discussions. Register here Scammers will pounce on global outage caused by CrowdStrike bug, Home Affairs Minister Clare O'Neil warns Date: 2024-07-20 Author: ABC News [Please see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0159/] AUSCERT has also shared IoCs via MISP Australians have been warned scammers and hackers are trying to capitalise on CrowdStrike-triggered outages to steal personal information including bank details and to gain access to computer systems. The unprecedented outage affected a raft of major institutions in Australia and internationally, including emergency services, government agencies, banks and airlines Microsoft releases Windows repair tool to remove CrowdStrike driver Date: 2024-07-21 Author: Bleeping Computer Microsoft has released a custom WinPE recovery tool to find and remove the faulty CrowdStrike update that crashed an estimated 8.5 million Windows devices on Friday. On Friday, CrowdStrike pushed out a faulty update that caused millions of Windows devices worldwide to suddenly crash with a Blue Screen of Death (BSOD) and enter reboot loops. This glitch caused massive IT outages, as companies suddenly found that all of their Windows devices no longer worked. These IT outages affected airports, hospitals, banks, companies, and government agencies worldwide. Telegram zero-day allowed sending malicious Android APKs as videos Date: 2024-07-22 Author: Bleeping Computer A Telegram for Android zero-day vulnerability dubbed 'EvilVideo' allowed attackers to send malicious Android APK payloads disguised as video files. A threat actor named 'Ancryno' first began selling the Telegram zero-day exploit on June 6, 2024, in a post on the Russian-speaking XSS hacking forum, stating the flaw existed in Telegram v10.14.4 and older. Australian cyber security firms to boost Indo-Pacific resilience Date: 2024-07-24 Author: Security Brief AUSCERT and the University of Queensland have announced a partnership with IDCARE to expand cyber security support across the Indo-Pacific under an Australian Government contract. The collaboration is part of the Cyber and Critical Tech Co-operation Program, aiming to bolster cyber resilience in Papua New Guinea and Fiji through tailored cyber-crime Windows July security updates send PCs into BitLocker recovery Date: 2024-07-24 Author: Bleeping Computer Microsoft warned that some Windows devices will boot into BitLocker recovery after installing the July 2024 Windows security updates. The BitLocker Windows security feature mitigates the risk of data theft or information exposure from lost, stolen, or inappropriately decommissioned devices by encrypting the storage drives. Windows computers can automatically enter BitLocker recovery mode following various events, including hardware and firmware upgrades or changes to the TPM (Trusted Platform Module), to restore access to BitLocker-protected drives that have not been unlocked via the default unlock mechanism. Over 3,000 GitHub accounts used by malware distribution service Date: 2024-07-24 Author: Bleeping Computer Threat actors known as 'Stargazer Goblin' have created a malware Distribution-as-a-Service (DaaS) from over 3,000 fake accounts on GitHub that push information-stealing malware. The malware delivery service is called Stargazers Ghost Network and it utilizes GitHub repositories along with compromised WordPress sites to distribute password-protected archives that contain malware. In most cases, the malware are infostealers, such as RedLine, Lumma Stealer, Rhadamanthys, RisePro, and Atlantida Stealer. ESB-2024.4781 – Google Chrome: CVSS (Max): None Google announced the release of Chrome 127 to the stable channel with patches for 24 vulnerabilities. As usual, memory safety bugs were the most common type of security flaw addressed, representing half of the reported issues, including four high-severity ones. ASB-2024.0159 – CrowdStrike sensor configuration update AUSCERT issued an advisory regarding the global outage caused by the sensor configuration update that impacted millions of Windows systems worldwide. ESB-2024.4758 – National Instruments IO Trace: CVSS (Max): None ICS-CERT has issued an advisory for a critical vulnerability (CVE-2024-5602) in National Instruments IO Trace, a network appliance. The issue, a stack-based buffer overflow, requires user interaction to exploit but could allow arbitrary code execution. A patch is available, and users are advised to minimize network exposure and use secure remote access methods. ESB-2024.4742 – IBM Security QRadar SIEM: CVSS (Max): 7.5 IBM Security QRadar SIEM has released updates to address multiple vulnerabilities, including CVE-2024-29415, which has a CVSS score of 7.5 for server-side request forgery. The updates also fix other issues such as denial of service and HTTP request smuggling. ESB-2024.4833 – ICSA-24-207-01 Siemens SICAM Products: CVSS (Max): 9.8 Siemens SICAM products are vulnerable to critical issues, including a severe password reset flaw (CVE-2024-37998) and a missing authentication issue (CVE-2024-39601). These vulnerabilities could lead to unauthorized access and potential information leaks. Users are advised to upgrade to the latest versions and disable auto login to mitigate risks. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 19th July 2024

Greetings, The winds picked up in the sunny state this week, bringing a noticeable drop in temperatures and allowing us to truly feel the winter chill. Perhaps we can also blame the winds for Queensland’s disappointing loss to New South Wales in the men's State of Origin. The Blues secured one of their greatest victories, defeating Queensland 14-4 at Suncorp Stadium, breaking a 19-year inability to win a decider there. Although it was a sad loss for the Maroons, we applaud the Blues for a good game and a great win. Until next time, Blues! This week, our analyst team distributed critical MSINS to affected members, alerting them to the Exim Flaw vulnerability, which is tracked as CVSS 9.1. Successful exploitation of this security defect could allow attackers to deliver executable attachments to inboxes, potentially leading to code execution and system compromise if the user opens the attachment. All organisations that had their Google Domains service migrated to Squarespace recently are advised to enable two-factor authentication on their Squarespace account, as it is not enabled by default. A number of cryptocurrency-related businesses appear to have been caught up in DNS hijacking attacks as a result of the way Squarespace migrated the service. Most of the noteworthy cases have been resolved; however, hundreds of domains are still alleged to be at risk of similar DNS hijacking, so it may not be over yet. It is crucial for organisations to adopt multi-factor authentication (MFA) to protect their data and maintain trust with customers and partners. By effectively implementing MFA, organisations can better defend against cyber threats and ensure the security of sensitive information. While MFA does not offer complete protection against all threats, it remains an essential component in reducing cyber security risks and safeguarding sensitive data. Atlassian Patches High-Severity Vulnerabilities in Bamboo, Confluence, Jira Date: 2024-07-17 Author: Security Week [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4634/] Software vendor Atlassian on Tuesday released security-themed updates to fix several high-severity vulnerabilities in its Bamboo, Confluence and Jira products. The Australian firm called urgent attention to the Bamboo Data Center and Server updates that resolve two high-severity bugs, including one affecting the UriComponentsBuilder dependency that could allow an unauthenticated attacker to perform a server-side request forgery (SSRF) attack. Critical Exim Flaw Allows Attackers to Deliver Malicious Executables to Mailboxes Date: 2024-07-12 Author: Security Week [AUSCERT has identified the impacted members (where possible) and contacted them via email] A critical vulnerability in over 1.5 million internet-accessible Exim mail transfer agent (MTA) installations potentially allows attackers to deliver malicious executables to user mailboxes, Censys warns. The issue, tracked as CVE-2024-39929 (CVSS score of 9.1) and impacting RFC 2231 header parsing, results in filenames being incorrectly parsed, which could allow remote attackers to bypass the filename extension-blocking protection mechanisms. Organizations Warned of Exploited GeoServer Vulnerability Date: 2024-07-16 Author: Security Week [AUSCERT contacted the potentially vulnerable members (where possible) on 04 July 2024] The US cybersecurity agency CISA is urging federal agencies to patch a critical-severity vulnerability in GeoServer as soon as possible, warning of evidence of active exploitation. The bug, tracked as CVE-2024-36401 (CVSS score of 9.8), is described as the unsafe evaluation of property names as XPath expressions, which could allow unauthenticated attackers to execute code remotely, through crafted input against a default GeoServer installation. Critical Apache HTTP Server Vulnerabilities Expose Millions of Websites Date: 2024-07-18 Author: Cyber Security News [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4720/] The Apache Software Foundation has disclosed several critical vulnerabilities in the Apache HTTP Server, which could potentially expose millions of websites to cyber-attacks. These vulnerabilities, identified by their Common Vulnerabilities and Exposures (CVE) numbers, affect various versions of the Apache HTTP Server and could lead to severe consequences such as source code disclosure, server-side request forgery (SSRF), and denial of service (DoS). Infoseccers claim Squarespace migration linked to DNS hijackings at Web3 firms Date: 2024-07-15 Author: The Register Security researchers are claiming a spate of DNS hijackings at web3 businesses is linked to Squarespace's acquisition of Google Domains last year. The theory is that cybercriminals may have picked up on a flaw in the method Squarespace used to migrate Google Domains customer data over to its servers, allowing them to guess the email addresses associated with admin accounts and register the account for themselves. Hackers use PoC exploits in attacks 22 minutes after release Date: 2024-07-13 Author: Bleeping Computer Threat actors are quick to weaponize available proof-of-concept (PoC) exploits in actual attacks, sometimes as quickly as 22 minutes after exploits are made publicly available. That is according to Cloudflare's Application Security report for 2024, which covers activity between May 2023 and March 2024 and highlights emerging threat trends. Cloudflare, which currently processes an average of 57 million HTTP requests per second, continues to see heightened scanning activity for disclosed CVEs, followed by command injections and attempts to weaponize available PoCs. ESB-2024.4635 – Google Chrome CVSS (Max): None The latest Chrome 126 update addresses several critical issues, including an inappropriate implementation flaw and a type confusion in V8, as well as use-after-free vulnerabilities in Screen Capture, Media Stream, Audio, and Navigation. Additionally, it fixes a race condition in DevTools and an out-of-bounds memory access in V8. ASB-2024.0134.2 – Oracle MySQL: CVSS (Max): 9.8 Oracle's latest quarterly Critical Patch Update addresses 386 security vulnerabilities, with 37 patches specifically for Oracle MySQL. Among these, 11 vulnerabilities can be exploited remotely without authentication. Notably, CVE-2023-37920 in MySQL Cluster is rated critical with a CVSS score of 9.8, potentially allowing remote attackers to exploit these vulnerabilities through simple network attacks. ESB-2024.4645 – Cisco Smart Software Manager On-Prem (SSM On-Prem): CVSS (Max): 10.0 Cisco has issued patches for a critical security flaw affecting Smart Software Manager On-Prem (Cisco SSM On-Prem). This vulnerability, identified as CVE-2024-20419 and rated with a maximum CVSS score of 10.0, could allow a remote, unauthenticated attacker to alter the passwords of any users, including administrative accounts. ESB-2024.4631 – Rockwell Automation Pavilion 8: CVSS (Max): 8.8 A vulnerability in Rockwell Automation Pavilion 8 permits a remote attacker to gain elevated privileges on the system. This security flaw arises from incorrect permission assignments on critical resources, enabling a remote user to access sensitive data and create new user accounts. ESB-2024.4633 – Mozilla Thunderbird: CVSS (Max): 9.8 The Mozilla Foundation has issued patches for vulnerabilities in Thunderbird 128. While these flaws generally cannot be exploited through email within Thunderbird due to disabled scripting when reading mail, they pose potential risks in browser or browser-like environments. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 12th July 2024

Greetings, This week, we celebrate NAIDOC Week, recognising the history, culture, and achievements of Aboriginal and Torres Strait Islander Peoples. NAIDOC Week offers an opportunity for all Australians to learn about First Nations cultures and histories and participate in celebrations of the oldest continuous living cultures on earth. Visit the NAIDOC website for a full list of local events. This month's Patch Tuesday brought significant updates, addressing 142 security flaws across various Microsoft products. Among these, two vulnerabilities were actively exploited in the wild, posing immediate threats to users. Additionally, two zero-day vulnerabilities, which had been publicly disclosed but not yet exploited, were patched. These zero-days are particularly concerning as there may be an exploit available before a fix is released. The update also fixed five critical vulnerabilities, all classified as remote code execution (RCE) flaws. These updates highlight the importance of regular patch management to protect systems from known threats. Users and organisations are strongly advised to apply these patches promptly to mitigate the risk of exploitation. Keeping systems updated is a crucial step in maintaining a secure IT environment and defending against cyber threats. The National Anti-Scam Centre is urging Australians who have had money stolen by scammers to be wary of offers to recover their money for an upfront fee. Reports involving a money recovery element are on the rise. Between December 2023 and May 2024, Scam watch received 158 reports with total losses exceeding $2.9 million, including losses from the original scams. The number of reports increased by 129 percent compared to the previous six months, while financial losses decreased by 29 percent from $4.1 million. Australians aged 65 and older were the largest reporting group and suffered the highest average losses. Victims of previous scams are easily identified by criminals who commonly keep and sell information about individuals they have exploited. The best method to stay ahead of cyber threats is through training and education. With the necessary skills and expertise, you can ensure that you and your organisation are always protected from attacks. Check out our online training schedules to find out how you can enhance your knowledge. It’s also important for victims of scams to feel able to report and share their experiences without judgement, so please share information about scams with less knowledgeable friends and family. New OpenSSH Vulnerability CVE-2024-6409 Exposes Systems to RCE Attack Date: 2024-07-10 Author: Cyber Security News Security researchers have discovered a new vulnerability in OpenSSH, identified as CVE-2024-6409, which could potentially allow remote code execution attacks on affected systems. This vulnerability, which affects OpenSSH versions 8.7 and 8.8, allows for potential remote code execution (RCE) due to a race condition in signal handling within the privilege separation (privsep) child process. Misconfigured Jenkins Servers Targeted in Cryptojacking Attacks Date: 2024-07-06 Author: Security Online [AUSCERT has identified the impacted members (where possible) and contacted them via email] [AUSCERT also shared IoCs and Attack Patterns via MISP] Trend Micro, a global leader in cybersecurity, has issued a warning about a recent wave of attacks targeting misconfigured Jenkins servers. Cybercriminals are exploiting vulnerabilities in the Jenkins Script Console to illicitly install and operate cryptocurrency mining software, siphoning computational resources from unsuspecting organizations. The Essential Eight Is An Opportunity To Drive New Strategic Value Into The Enterprise Date: 2024-07-08 Author: IT News The Australian Cyber Security Centre (ACSC)’s Essential Eight framework has the potential to transform Australia into a global leader in cyber security. However, in challenging organisations to develop a more strategic approach to cyber security, it also introduces some new risks to IT environments that enterprises are going to need to grapple with in the coming years. SAP Patches High-Severity Vulnerabilities in PDCE, Commerce Date: 2024-07-09 Author: Security Week Enterprise software maker SAP on Tuesday announced the release of 16 new and two updated security notes as part of its July 2024 patch day, including two notes dealing with high-severity vulnerabilities. The most severe of the issues is a missing authorization check in PDCE (Product Design Cost Estimating), a lifecycle costing tool. Tracked as CVE-2024-39592 (CVSS score of 7.7/10), the bug could allow an attacker to read generic table data, according to SAP. RADIUS Protocol Vulnerability Exposes Networks to MitM Attacks Date: 2024-07-09 Author: The Hacker News [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0130] Cybersecurity researchers have discovered a security vulnerability in the RADIUS network authentication protocol called BlastRADIUS that could be exploited by an attacker to stage Mallory-in-the-middle (MitM) attacks and bypass integrity checks under certain circumstances. "The RADIUS protocol allows certain Access-Request messages to have no integrity or authentication checks," InkBridge Networks CEO Alan DeKok, who is the creator of the FreeRADIUS Project, said in a statement. Nearly 10bn passwords posted to hacking forum Date: 2024-07-08 Author: Cyber Daily The user – named ObamaCare – made the post on 4 July on a popular hacking forum, sharing a file called rockyou2024.txt. “Xmas came early this year,” ObamaCare said. “I present to you a new rockyou2024 password list with over 9.9 billion passwords.” “I updated rockyou21 with collected new data from recent leaked databases in various forums over this and last years.” The shared list has 9,948,575,739 passwords in all, and it appears to be a compilation of new and old leaks compiled into a single list. The file is a 45.6 gigabyte .zip archive. ASB-2024.0122 – Microsoft Windows: CVSS (Max): 9.8 For July 2024 Patch Tuesday, Microsoft’s security updates and patches address two zero-day vulnerabilities currently being exploited: CVE-2024-38080 in Windows Hyper-V and CVE-2024-38112 in the Windows MSHTML Platform. ESB-2024.4425.2 – Citrix Netscaler Products: CVSS (Max): 9.4 Citrix has disclosed two critical vulnerabilities impacting its NetScaler Console, NetScaler SVM, and NetScaler Agent, which could potentially enable attackers to access sensitive information and launch denial of service attacks. The vulnerabilities, designated as CVE-2024-6235 and CVE-2024-6236, have led Citrix to issue urgent update recommendations to mitigate these risks. ESB-2024.4427 – Palo Alto Networks Expedition: CVSS (Max): 9.3 Palo Alto Networks has issued security updates to address several vulnerabilities affecting its products, including a critical flaw that could enable authentication bypass. Tracked as CVE-2024-5910 this vulnerability is characterized as a missing authentication issue in the Expedition migration tool, potentially allowing unauthorized access to an administrator account. ESB-2024.4429 – VMware Aria Automation: CVSS (Max): 8.5 VMware has issued security updates to address a high-severity vulnerability in their Aria Automation product. This vulnerability, a structured query language (SQL) injection flaw, could allow an authenticated attacker to execute unauthorized read or write operations in the database by sending specially crafted SQL queries. ESB-2024.4428.2 – GitLab Community and Enterprise editions: CVSS (Max): 9.6 GitLab has released a new set of updates to address security vulnerabilities in its software development platform, including a critical flaw that enables an attacker to execute pipeline jobs as any arbitrary user. Tracked as CVE-2024-6385, this vulnerability has a CVSS score of 9.6. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 5th July 2024

Greetings, This week, we published the AUSCERT2024 recordings! To re-live your favourite sessions, head to our YouTube channel to watch them. We featured many exciting sessions that made the event truly unforgettable. This year, the conference focused on industry technology, modernizing infrastructure, data governance, and the legal aspects of cyber security. One highlight to revisit is the live Risky Biz recording with Adam Boileau and Patrick Gray, in which they discussed some very interesting topics. MISP was another hot topic, with our Senior Security Systems Administrator, Josh Hopkins, leading a session on modernising MISP by applying Infrastructure as Code principles to your MISP services. Data governance was another significant focus at AUSCERT2024. In Trinity McNicol’s session, she explored how organisations can manage data-related risks, protect data assets, leverage data for decision-making, meet consumer privacy expectations, and ensure compliance with data protection legislation. Cyber security frameworks can also help organisations understand their cyber health and improve overall resilience. The Cyber Health Check Program Panel discussion went beyond theory, offering real-world case studies that highlight successful cyber security enhancements. Watch as the team embarks on an enlightening exploration of cyber security framework essentials. Piotr Kijewski’s session provided an overview of how Shadowserver functions as a large-scale information collection and sharing project, collaborating with the global Internet defender community. Piotr described their recent journey in search of sustainability and concluded with their vision of continuing the mission to raise the bar on global cyber security without compromising their principles of free threat intelligence sharing. Darren Kitchen’s session was a highly anticipated keynote, in which he shared tales of device deception from nearly 20 years of experience with Hak5. He discussed the innovative implants and deceptive devices equipping red teams worldwide. Darren’s successful penetration tests have resulted in a multitude of real-world stories that proved effective. We concluded with a captivating Speed Debate featuring exciting, witty, and comical topics. Watch this session for a good laugh! The Cyber Security Conference actively focuses on community, value, and upskilling the workforce in a fun and inclusive environment. This year was no exception, with around 900 delegates attending across the four days. We can’t wait for next year, but in the meantime we have the videos to keep us entertained! Google Patches 25 Android Flaws, Including Critical Privilege Escalation Bug Date: 2024-07-02 Author: Security Week [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4145/] Google has released patches for 25 documented security vulnerabilities in the Android operating system, including a critical-severity flaw in the Framework component. The critical bug, tracked as CVE-2024-31320, impacts Android versions 12 and 12L and allows an attacker to escalate privileges on a vulnerable device. “The most severe of these issues is a critical security vulnerability in the Framework component that could lead to local escalation of privilege with no additional execution privileges needed,” Google explains in an advisory. Cisco warns of NX-OS zero-day exploited to deploy custom malware Date: 2024-07-01 Author: Bleeping Computer [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4143/] Cisco has patched an NX-OS zero-day exploited in April attacks to install previously unknown malware as root on vulnerable switches. Cybersecurity firm Sygnia, who reported the incidents to Cisco, linked the attacks to a Chinese state-sponsored threat actor it tracks as Velvet Ant. "Sygnia detected this exploitation during a larger forensic investigation into the China-nexus cyberespionage group we are tracking as Velvet Ant," Amnon Kushnir, Director of Incident Response at Sygnia, told BleepingComputer. Splunk Patches High-Severity Vulnerabilities in Enterprise Product Date: 2024-07-02 Author: Security Week [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4152/] Splunk on Monday announced patches for 16 vulnerabilities in Splunk Enterprise and Cloud Platform, including six high-severity bugs. Three of the high-severity issues are remote code execution flaws that require authentication for successful exploitation. The first of them, tracked as CVE-2024-36985, could be exploited by a low-privileged user through a lookup that likely references the ‘splunk_archiver’ application. The issue affects Splunk Enterprise versions 9.2.x, 9.1.x, and 9.0.x. New regreSSHion OpenSSH RCE bug gives root on Linux servers Date: 2024-07-01 Author: Bleeping Computer [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0121/] A new OpenSSH unauthenticated remote code execution (RCE) vulnerability dubbed "regreSSHion" gives root privileges on glibc-based Linux systems. OpenSSH is a suite of networking utilities based on the Secure Shell (SSH) protocol. It is extensively used for secure remote login, remote server management and administration, and file transfers via SCP and SFTP. The flaw, discovered by researchers at Qualys in May 2024, and assigned the identifier CVE-2024-6387, is due to a signal handler race condition in sshd that allows unauthenticated remote attackers to execute arbitrary code as root. Juniper releases out-of-cycle fix for max severity auth bypass flaw Date: 2024-06-30 Author: Bleeping Computer [See AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.4117/] Juniper Networks has released an emergency update to address a maximum severity vulnerability that leads to authentication bypass in Session Smart Router (SSR), Session Smart Conductor, and WAN Assurance Router products. The security issue is tracked as CVE-2024-2973 and an attacker could exploit it to take full control of the device. Gov launches 'overdue' cyber security network for health sector Date: 2024-07-01 Author: iTnews Mirroring a model already used in the financial and critical infrastructure sectors, the pilot Information Sharing and Analysis Centre (ISAC) will focus on “cyber threats, responses and preventative measures” among health organisations. Minister for Home Affairs and cyber security Clare O’Neil said healthcare organisations’ “access to sensitive data”, and their “struggle with building and funding strong cyber protections”, had made them a threat target. “The last two years has been the beginning of a big, overdue national journey to lift up cyber security across the country to better protect our citizens,” she said in a statement. ESB-2024.4245 – PHP: CVSS (Max): 9.8 Ubuntu has fixed a vulnerability in PHP. The update caused a regression in parsing XML in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. ESB-2024.4211 – python-Js2Py: CVSS (Max): 9.6 SUSE has released an update that solves a vulnerability for a potential sandbox escape via untrusted JavaScript code. ESB-2024.4144.2 – OpenSSH: CVSS (Max): 8.1 OpenSSH incorrectly handled signal management which could allow an attacker to bypass authentication and remotely access systems without proper credentials. Fixes were released to patch this vulnerability. ESB-2024.4164 – Splunk Enterprise: CVSS (Max): 9.8 Splunk remedied common vulnerabilities and exposures (CVEs) in Third Party Packages in Splunk Enterprise versions 9.2.1, 9.1.4, 9.0.9 and higher. ESB-2024.4174 – mySCADA myPRO: CVSS (Max): 9.8 mySCADA released an update for myPRO to address a vulnerability that could allow an attacker to remotely execute code on affected devices. Stay safe, stay patched and have a good weekend! The AusCERT team

Learn more

Week in review

AUSCERT Week in Review for 28th June 2024

Greetings, Events this week underscored the critical importance of staying updated on the latest cyber security threats and trends. Australia’s proactive approach to implementing security measures and educating the community plays a crucial role in mitigating risks and enhancing overall cyber resilience. The week began with an alert from the Australian Cyber Security Centre (ACSC) highlighting increased cyber threat activity targeting Snowflake customers. Businesses and critical infrastructure in Australia were advised to bolster their security measures and remain vigilant against potential attacks. Many organisations applied Microsoft's June 2024 Patch Tuesday updates, which addressed 51 vulnerabilities, including 18 critical remote code execution flaws. Addressing these vulnerabilities promptly helps organisations mitigate the risks associated with commonly used applications and systems. In other news, a Wednesday court filing provided some details about the September 2022 Optus data breach, from the perspective of Australia's Communications and Media Authority (ACMA). ACMA is leveraging its regulatory powers to pursue Optus, alleging that the company failed to adequately protect personally identifiable customer information, including failing to fix an identified coding error in all of its Internet-visible APIs and to continue to operate a vulnerable API for two years despite there being no need for its operation. The filing states that “The cyber attack was not highly sophisticated nor did it require advanced skills or proprietary knowledge of Optus's processes or systems. It was executed through a simple process of trial and error,”. ACMA is seeking civil penalties in the case. Singtel, the parent company of Optus, has advised investors that it cannot determine the quantum of penalties but will defend the case. This incident exemplifies how regulatory bodies are intensifying their efforts to hold organisations accountable for failing to adhere to appropriate practices in safeguarding personal information. Ensure your organisation is compliant with the necessary regulatory standards. If you need assistance in analysing your organisation's cyber security maturity level, contact our team at – grc@auscert.org.au. Cyber threats surge during Australia's EOFY tax season Date: 2024-06-25 Author: Security Brief As the end of the financial year (EOFY) approaches in Australia, organisations and individuals find themselves preoccupied with tax returns, financial statements, and compliance reports. This busy period also brings with it a heightened risk of cyber threats, creating a favourable environment for scammers and cybercriminals. Analysts have noted an uptick in seasonal cyber activities during the EOFY period, exploiting the chaos and urgency associated with tax-related activities. The most common threats include phishing scams, ransomware, business email compromise (BEC), and identity theft. If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately Date: 2024-06-25 Author: The Register [AUSCERT has identified the impacted members (where possible) and contacted them via email] The polyfill.io domain is being used to infect more than 100,000 websites with malware after a Chinese organization bought the domain earlier this year. Multiple security firms sounded the alarm on Tuesday, warning organizations whose websites use any JavaScript code from the pollyfill.io domain to immediately remove it. The site offered polyfills – useful bits of JavaScript code that add functionality to older browsers that is built into newer versions. These in-fills make life easier for developers in that by using polyfillers, they know their web code will work across a greater range of browsers. Progress quietly fixes MOVEit auth bypass flaws (CVE-2024-5805, CVE-2024-5806) Date: 2024-06-25 Author: Help Net Security [AUSCERT has identified the impacted members (where possible) and contacted them via email] Progress Software has patched one critical (CVE-2024-5805) and one high-risk (CVE-2024-5806) vulnerability in MOVEit, its widely used managed file transfer (MFT) software product. According to WatchTowr Labs researchers, the company has been privately instructing users to implement the hotfixes before they go public with the information. Hacker Claims Theft of 30M User Records From Australia Ticketing Company TEG Date: 2024-06-24 Author: Security Week A threat actor is boasting on a hacking forum the theft of information pertaining to millions of Ticketek users, roughly three weeks after the company acknowledged a data breach. On May 31, Ticketek Entertainment Group (TEG), an Australia-based live events and ticketing firm, announced that user account information had been compromised after hackers accessed a database stored on a cloud-based platform. “The available evidence at this time indicates that, from a privacy perspective, customer names, dates of birth and email addresses may have been impacted,” TEG said. Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack Date: 2024-06-25 Author: Ars Technica WordPress plugins running on as many as 36,000 websites have been backdoored in a supply-chain attack with unknown origins, security researchers said on Monday. ESB-2024.4118 – GitLab: CVSS (Max): 9.6* Gitlab has released critical patches for GitLab Community Edition (CE) and Enterprise Edition (EE). ESB-2024.4099 – SQLite: CVSS (Max): 9.8 SQLite could be made to crash or execute arbitrary code. ESB-2024.4076 – OpenVPN: CVSS (Max): 9.8 OpenVPN could allow unintended access to network services. ESB-2024.4073 – git: CVSS (Max): 9.0 Multiple vulnerabilities were found in git, a fast, scalable and distributed revision control system. ESB-2024.4019.2 – Google Chrome: CVSS (Max): None Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Stay safe, stay patched and have a good weekend! The AusCERT team

Learn more

Week in review

AUSCERT Week in Review for 21st June 2024

Greetings, We are thrilled to announce the release of another exciting episode of our podcast 'Share Today, Save Tomorrow'! In Episode 35: "Introducing Ivano", Anthony sits down with AUSCERT’s new General Manager, Ivano Bongiovanni, to discuss his career journey and future aspirations for AUSCERT. In the second half, Bek chats with Michael McAlary from AUSCERT about the recent makeover and improved user experience of the AUSCERT Member Portal, as well as future enhancements. Don't miss this insightful conversation! In other news, as a result of the ongoing legal action by the Australian Information Commissioner, more details have been released this week of the 2022 MediBank Private breach. It has been alleged that one of the causes behind the breach was the failure to implement multi-factor authentication (MFA) for authenticating remote access users. The MediBank story coincides with research released by Cisco Talos which links aspects of MFA to approximately half of the incidents investigated in the first quarter of 2024. Talos describes the underlying cause of 25% of incidents being users accepting attacker-originated push notifications, while 21% of incidents were caused by incorrect implementation of MFA solutions. Both of these news stories highlight the critical importance of integrating information security controls across the domains of people, processes, and technology. Security controls are only as effective as the people who design, implement and use them. Regular training and awareness programs ensure that employees understand the importance of security protocols, such as multi-factor authentication (MFA), and know how to respond to security threats. Explore our available training courses to enhance your knowledge of cybersecurity threats. Critical Code Execution Vulnerabilities Patched in VMware vCenter Server Date: 2024-06-18 Author: Security Week [AUSCERT has identified the impacted members (where possible) and contacted them via email] [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.3915/] Broadcom-owned VMware has announced patches for several serious vCenter Server vulnerabilities that can allow remote code execution or privilege escalation. Two heap-overflow vulnerabilities, tracked as CVE-2024-37079 and CVE-2024-37080 and classified as having critical severity, impact the implementation of the DCERPC protocol. New Wi-Fi Takeover Attack—All Windows Users Warned To Update Now Date: 2024-06-14 Author: Forbes [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0119/ ] Microsoft has confirmed a new and quite alarming Wi-Fi vulnerability in Windows, which has been rated 8.8 out of 10 in terms of severity using the Common Vulnerability Scoring System. The vulnerability, assigned as CVE-2024-30078, does not require an attacker to have physical access to the targeted computer, although physical proximity is needed. Ransomware Attacks Are Getting Worse Date: 2024-06-15 Author: WIRED Despite years worth of efforts to eliminate the scourge of ransomware targeting schools, hospitals, and critical infrastructure worldwide, experts are warning that the crisis is only heating up, with criminal gangs growing ever more aggressive in their tactics. The threat of real-world violence now looms, some experts warn, as the data stolen grows increasingly sensitive and millions in potential profits hang in the balance. “We know where your CEO lives,” read a message reportedly received by one victim. Attacks targeting the medical sector are blooming in response to the $44 million payout by Change Healthcare this March. Australian businesses targeted in Russia-based phishing campaign Date: 2024-06-14 Author: Cyber Daily A security researcher with Sophos X-Ops – the security company’s threat response team – has outlined a widespread phishing campaign based in Russia that targeted almost 800 businesses, individuals, and even elections. Throughout late 2023, a campaign that appears to have originated in Russia sent out more than 2,000 phishing emails in an attempt to steal login credentials and money via gift card scams. Hackers use F5 BIG-IP malware to stealthily steal data for years Date: 2024-06-17 Author: Bleeping Computer A group of suspected Chinese cyberespionage actors named 'Velvet Ant' are deploying custom malware on F5 BIG-IP appliances to gain a persistent connection to the internal network and steal data. According to a Sygnia report who discovered the intrusion after they were called in to investigate the cyberattack, Velvet Ant established multiple footholds using various entry points across the network, including a legacy F5 BIG-IP appliance that served as an internal command and control (C2) server. ESB-2024.3915 – VMware Products: CVSS (Max): 9.8 Broadcom has issued a security patch for VMware vCenter Server, a widely-used management platform, to fix critical and high-severity vulnerabilities such as CVE-2024-37079, CVE-2024-37080, and CVE-2024-37081. AUSCERT has identified the affected members and issued a critical MSIN accordingly. ASB-2024.0119 – Windows Wi-Fi Driver: CVSS (Max): 8.8 Microsoft has acknowledged a significant Wi-Fi vulnerability in Windows, which has received a severity rating of 8.8 out of 10. Designated as CVE-2024-30078, this vulnerability does not necessitate physical access to the targeted computer but does require physical proximity. ESB-2024.3833 – Google Chrome: CVSS (Max): None Mozilla has addressed a critical CVE where, under certain conditions, a malicious website could attempt to display a fake location URL in the address bar, potentially misleading users about the actual website they are visiting. This vulnerability affects Firefox for iOS. ASB-2024.0120 – Trellix IPS Manager: CVSS (Max) 9.8 Trellix has patched a critical security vulnerability in its Intrusion Prevention System (IPS) Manager, tracked as CVE-2024-5671. This flaw, caused by insecure deserialization in certain workflows, could allow unauthenticated remote attackers to execute arbitrary code, posing a severe risk to network security. ESB-2024.3912 – Atlassian Products: CVSS (Max) 8.2 Atlassian has fixed 9 high-severity vulnerabilities to address improper authorization, server-side request forgery and denial of service. Atlassian recommends patching to latest versions to resolve these vulnerabilities. Stay safe, stay patched and have a good weekend! The AUSCERT Team

Learn more

Week in review

AUSCERT Week in Review for 14th June 2024

Greetings, This week, the Australian Signals Directorate (ASD) released an update to remind small and medium businesses to assess their cyber health. As we enter a period of heightened threats and attacks, it is crucial that every business is equipped with the appropriate resources and knowledge to ensure they are cyber resilient. For small and medium-sized businesses with limited resources, prioritising the most critical elements of cyber health is essential. Cyber attacks are occurring more frequently, and recovery can be costly, making every Australian business a potential target. In the 2022-23 financial year, the average cost of cybercrime for small businesses increased to $46,000, and for medium businesses, it rose to $97,000. Such costs could potentially destroy a business, driving it into liquidation. Australian small and medium businesses can take practical steps to enhance their cyber security by implementing the Essential Eight, which covers many of the critical elements of cyber health. AUSCERT offers members advice and consultations to help improve their cyber security readiness in alignment with their business objectives. We specialise in helping organisations confidently adhere to industry frameworks, standards, and benchmarks. Our maturity assessments are designed to identify and address cyber security gaps in your organisation. By taking proactive steps, you can enhance your cyber security posture and reduce information security risks. The recent Medibank case should serve as a wake-up call to Australian organisations to invest in their digital defences to meet the challenges of an evolving cyber landscape. All organisations have an ethical duty to protect the personal information they are entrusted with and many have regulatory and contractual obligations as well. The civil penalty proceedings filed by the Australian Information Commissioner against Medibank, in relation to its October 2022 data breach, exemplifies the regulatory body’s commitment to holding parties accountable. The Commissioner claims Medibank failed to take reasonable steps to protect personal information from 9.7 million Australians, in breach of the Privacy Act 1988. This failure led to the release of personal information on the dark web, exposing many Australians to severe negative ramifications. Contact us today for more information on how we can conduct a maturity assessment for your organisation and support you in meeting your business objectives. New PHP Vulnerability Exposes Windows Servers to Remote Code Execution Date: 2024-06-08 Author: The Hacker News [AUSCERT has identified the impacted members (where possible) and contacted them via email] [Please also see AUSCERT bulletin:https://portal.auscert.org.au/bulletins/ASB-2024.0111/] Details have emerged about a new critical security flaw impacting PHP that could be exploited to achieve remote code execution under certain circumstances. The vulnerability, tracked as CVE-2024-4577, has been described as a CGI argument injection vulnerability affecting all versions of PHP installed on the Windows operating system. According to DEVCORE security researcher, the shortcoming makes it possible to bypass protections put in place for another security flaw, CVE-2012-1823. Microsoft Outlook Zero-Click RCE Flaw Executes as Email is Opened Date: 2024-06-12 Author: Cyber Security News [See AUSCERT ASB https://portal.auscert.org.au/bulletins/ASB-2024.0117] A critical zero-click remote code execution (RCE) vulnerability has been discovered in Microsoft Outlook. This vulnerability, designated as CVE-2024-30103, enables attackers to run arbitrary code by sending a specially designed email. When the recipient opens the email, the exploit is triggered. The vulnerability, CVE-2024-30103, is particularly alarming due to its zero-click nature. Unlike traditional phishing attacks that require user interaction, this flaw can be exploited without any action from the user. Google warns of actively exploited Pixel firmware zero-day Date: 2024-06-12 Author: Bleeping Computer Google has released patches for 50 security vulnerabilities impacting its Pixel devices and warned that one of them had already been exploited in targeted attacks as a zero-day. Tracked as CVE-2024-32896, this elevation of privilege (EoP) flaw in the Pixel firmware has been rated a high-severity security issue. Azure Service Tags could allow attackers to access private data Date: 2024-06-04 Author: ThreatDown [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0110/] Security researchers at Tenable have published a blog about what they call a vulnerability in Azure, a description that Microsoft denies. Long story, very short: It’s not a bug, it’s a feature, unless you use it incorrectly. Tenable points out that it’s possible for an attacker to bypass firewall rules based on Azure Service Tags by forging requests from trusted services. Azure Service Tags are intended to simplify network isolation. It allows you to group IP ranges and use them to define network security rules. Exploit for critical Veeam auth bypass available, patch now Date: 2024-06-10 Author: Bleeping Computer A proof-of-concept (PoC) exploit for a Veeam Backup Enterprise Manager authentication bypass flaw tracked as CVE-2024-29849 is now publicly available, making it urgent that admins apply the latest security updates. Veeam Backup Enterprise Manager (VBEM) is a web-based platform for managing Veeam Backup & Replication installations via a web console. It helps control backup jobs and perform restoration operations across an organization's backup infrastructure and large-scale deployments. Veeam issued a security bulletin about the critical flaw on May 21, warning about a critical vulnerability enabling remote unauthenticated attackers to log in to VBEM's web interface as any user. SolarWinds Patches High-Severity Vulnerability Reported by NATO Pentester Date: 2024-06-07 Author: Security Week [AUSCERT has identified the impacted members (where possible) and contacted them via email] SolarWinds this week announced patches for multiple high-severity vulnerabilities in Serv-U and the SolarWinds Platform, including a bug reported by a penetration tester working with NATO. Rolling out as version 2024.2, the latest SolarWinds Platform iteration includes patches for three new security defects, as well as fixes for multiple bugs in third-party components. ASB-2024.0112 – Pytorch: CVSS (Max): 10.0 A significant flaw (CVE-2024-5480) has been unearthed within PyTorch's distributed RPC framework, leaving machine learning models and confidential data vulnerable to potential remote code execution threats. AUSCERT strongly advises PyTorch users to follow the vendor's mitigation recommendations in order to safeguard themselves effectively. ASB-2024.0113 – Microsoft Windows: CVSS (Max): 9.8 During the June 2024 Patch Tuesday, Microsoft rolled out remedies for a critical vulnerability, CVE-2024-30080, concerning MSMQ (Microsoft Message Queuing). This flaw, characterized by a use-after-free vulnerability, exposes MSMQ to potential exploitation by unauthenticated attackers. Through the transmission of a specially crafted malicious MSMQ packet to an MSMQ server, these attackers can achieve remote code execution (RCE). ASB-2024.0115 – Microsoft Azure: CVSS (Max): 8.1 AUSCERT's advisory warns its members regarding a vulnerability in Microsoft Azure. This flaw enables malicious actors to circumvent firewall regulations relying on Azure Service Tags by fabricating requests originating from trusted services. A threat actor could exploit Service Tags authorized by a user's firewall in the absence of supplementary validation controls. ASB-2024.0111.2 – PHP Vulnerability impacting Windows Servers – CVE-2024-4577 A recent advisory from AUSCERT alerted its members to a vulnerability affecting all versions of PHP installed on the Windows operating system. This vulnerability has now been included in CISA's Known Exploited Vulnerabilities Catalog due to evidence of ongoing exploitation. AUSCERT emphasizes the importance of adhering to the vendor's recommended mitigation measures to ensure protection. ESB-2024.3761 – Adobe FrameMaker Publishing Server: CVSS (Max): 10.0 In its latest patch release, Adobe addressed two critical CVEs in its FrameMaker Publishing Server, which could result in privilege escalation. With a CVSS score of 10, it is crucial to apply these patches promptly to ensure protection. ASB-2024.0117 – Microsoft Office, Microsoft Office Services and Web Apps: CVSS (Max): 8.8 A critical zero-click remote code execution (RCE) vulnerability has been identified in Microsoft Outlook which allows attackers to execute arbitrary code through the receipt of a specifically crafted email. Upon opening the email, the exploit is activated. The seriousness of CVE-2024-30103 stems from its zero-click nature. Unlike conventional phishing attempts that rely on user interaction, this flaw can be exploited without any action required from the user. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 7th June 2024

Greetings, With tax season close, AUSCERT is urging vigilance, as this is a prime time for cybercriminals to target unsuspecting people through phishing scams. These scams are typically circulated via various channels, including emails, phone calls, text messages, and fake websites. Malicious actors often increase their fraudulent activities during this period to take advantage of the heightened financial activity. AUSCERT has observed a significant increase in phishing scams impersonating MyGov and the Australian Taxation Office (ATO) during previous tax seasons. From July to October in 2022, AUSCERT received reports of around 1,100 tax-related phishing emails and scams, surging to approximately 2,500 in 2023. By staying informed and following best practices for online security, individuals can reduce the risk of falling victim to ATO and MyGov-related phishing scams. This week, concerning news emerged in the area of supply chain cyber security. Australian electronic prescription provider MediSecure has gone into administration. This follows a data breach reported in mid-May 2024, in which 6.5 terabytes of prescription data were stolen and leaked on a cybercrime forum. Last week, the Minister for Cyber Security, Clare O’Neil, publicly criticised MediSecure for the "unacceptably long time" it took to provide important information about the stolen customer data. Meanwhile, cloud storage and data analytics company Snowflake was the centre of a data breach impacting several high-profile customers, including Ticketmaster. Described by some in the media as "the world’s biggest data breach — in terms of impacted individuals," this incident underscores how supply chain risks can have far-reaching consequences. It also highlights the importance of understanding and utilising the security controls provided by service providers. Reports suggest that some of Snowflake’s customers were compromised due to single-factor authentication and use of stolen credentials. The best proactive approach to staying ahead of cyber threats is to ensure that you and all members of your organization are equipped with the most relevant knowledge. Stay informed and vigilant by visiting our training website to explore the available courses you can enrol in today! Largest ever operation against botnets hits dropper malware ecosystem Date: 2024-05-30 Author: Europol [AUSCERT has identified the impacted members (where possible) and contacted them via email] Between 27 and 29 May 2024 Operation Endgame, coordinated from Europol’s headquarters, targeted droppers including, IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot. The actions focused on disrupting criminal services through arresting High Value Targets, taking down the criminal infrastructures and freezing illegal proceeds. This approach had a global impact on the dropper ecosystem. The malware, whose infrastructure was taken down during the action days, facilitated attacks with ransomware and other malicious software. AUSCERT warns companies and individuals alike to be aware of tax scams Date: 2024-06-04 Author: Cyber Daily Tax time rolls around every year with the inevitability of death, but while tax and death have long been considered to go oddly hand in hand, the modern, connected world has thrown a third spanner into the mix. Scams. As Australians all over the country turn to their accountants and yearly finances, so do scammers, who relentlessly conjure new ways to bilk victims out of either their personal data or their hard-earned cash. CISA Warns of Attacks Exploiting Old Oracle WebLogic Vulnerability Date: 2024-06-04 Author: Security Week [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2017.0038/] The US cybersecurity agency CISA on Monday added an old Oracle WebLogic flaw to its Known Exploited Vulnerabilities (KEV) catalog after it was seen being exploited by Chinese hackers to deploy cryptocurrency miners. The vulnerability, tracked as CVE-2017-3506, affects Oracle WebLogic Server and allows an unauthenticated attacker to access or modify critical data, enabling arbitrary OS command execution. Attackers can achieve remote code execution via specially crafted HTTP requests. CVE-2024-2876: WordPress Plug-in Threatens 90,000+ websites Date: 2024-06-06 Author: Wallarm [AUSCERT has identified the impacted members (where possible) and contacted them via email] A highly concerning security loophole was recently discovered in a WordPress plugin called "Email Subscribers by Icegram Express," a popular tool utilized by a vast network of over 90,000+ websites. Officially designated as CVE-2024-2876 with a CVSS score of 9.8 (critical), the vulnerability represents a significant threat as it exposes numerous websites to potential attacks. Threat actor compromising Snowflake database customers Date: 2024-05-31 Author: TechTarget [Please see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0109] [AUSCERT has also shared IoCs associated with the Snowflake incident via MISP ] A threat actor has breached customers of cloud storage and analytics giant Snowflake by using stolen credentials to access databases, according to cloud security vendor Mitiga. According to a blog post published Thursday, the threat actor, tracked as UNC5537, "has been observed using stolen customer credentials to target organizations utilizing Snowflake databases" to conduct data theft and extortion-related activity. Apache HugeGraph-Server – Remote Command Execution (CVE-2024-27348) – Vulnerability & Exploit Database Date: 2024-06-04 Author: Pentest Tools Vulnerability description Apache HugeGraph-Server is an open-source graph database that provides a scalable and high-performance solution for managing and analyzing large-scale graph data. It is commonly used in Java8 and Java11 environments. However, versions prior to 1.3.0 are vulnerable to a remote command execution (RCE) vulnerability in the gremlin component. Risk description The risk exists that a remote unauthenticated attacker can fully compromise the server to steal confidential information, install ransomware, or pivot to the internal network. ASB-2024.0109.2 – Potentially compromised Snowflake environments A cyber security incident involving Snowflake customer environments has been reported, potentially affecting large companies. ESB-2024.3426.2 – Jenkins Plugins: CVSS (Max): 8.0 Jenkins has discovered vulnerabilities in OpenText Application Automation Tools Plugin, Report Info Plugin, and Team Concert Git Plugin, including stored XSS, XXE attacks, missing permission checks, and path traversal, with fixes available for some plugins. ESB-2024.3544 – Red Hat Enterprise Linux BaseOS AUS (v.8.2): CVSS (Max): 7.8 CISA added Linux Kernel Vulnerability (CVE-2024-1086) to its Known Exploited Vulnerabilities (KEV) catalog, warning that threat actors are targeting it in the wild. ESB-2024.3556 – Android: CVSS (Max): 9.3 The Android Security Bulletin addresses multiple critical vulnerabilities, including severe local privilege escalation issues. Users are urged to update their devices to enhance protection through the latest Android security platform and Google Play Protect measures. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 31st May 2024

Greetings, Following the amazing experience we had last week, the AUSCERT team dove straight back into work this week, leveraging the rich knowledge shared throughout the conference. With many new initiatives and projects on the horizon, our organisation is experiencing significant growth and development. Each year, our key highlight from AUSCERT2024 is reconnecting with members we’ve met before, meeting new ones, and strengthening our community bond. Beyond the cutting-edge education, the conference's vibrant community fostered idea-sharing and facilitated valuable networking opportunities. This year, we decided to give back to the community by donating the proceeds from our speaker gifts to a valuable charity in Australia. We chose RizeUp Australia, a community-driven organisation of passionate people dedicated to supporting families affected by domestic and family violence. RizeUp Australia goes beyond raising awareness through speaking engagements. They have developed various programs to support and empower families via specialist domestic and family violence organisations. Their efforts include helping victims create new homes after fleeing violent situations, supporting children in their healing process, and raising much-needed funds for families who often have nothing but the clothes on their backs. AUSCERT prioritised raising $6,500 to fund a whole house for families impacted by domestic violence. Thanks to the incredible support from our community, we exceeded our goal and raised nearly $10,000, which was directly donated to the RizeUp Foundation. These funds are dedicated to making a tangible difference in the lives of vulnerable individuals. Our mission was to create a significant impact and give back to the community, advocating for change to transform the cultural norms that adversely affect many lives in our nation. Google Patches Fourth Chrome Zero-Day in Two Weeks Date: 2024-05-24 Author: Security Week [Please also see AUSCERT bulletin: https://portal.auscert.org.au/bulletins/ESB-2024.3425/] Google on Thursday rolled out a fresh Chrome update to address another exploited vulnerability in the popular web browser, the fourth zero-day to be patched in two weeks. Tracked as CVE-2024-5274, the high-severity flaw is described as a type confusion in the V8 JavaScript and WebAssembly engine. “Google is aware that an exploit for CVE-2024-5274 exists in the wild,” the internet giant noted in an advisory. Exploit released for maximum severity Fortinet RCE bug, patch now Date: 2024-05-28 Author: Bleeping Computer [Please also see AUSCERT's updated bulletin: https://portal.auscert.org.au/bulletins/ASB-2024.0035.3/] Security researchers have released a proof-of-concept (PoC) exploit for a maximum-severity vulnerability in Fortinet's security information and event management (SIEM) solution, which was patched in February. Tracked as CVE-2024-23108, this security flaw is a command injection vulnerability discovered and reported by Horizon3 vulnerability expert Zach Hanley that enables remote command execution as root without requiring authentication. Remote Code Execution Threatens Qlik Sense Users Date: 2024-05-23 Author: Security Online [AUSCERT has identified the impacted members (where possible) and contacted them via email] Qlik, a prominent player in the data analytics space, has issued a critical security advisory warning users of a high-risk vulnerability (CVE-2024-36077) in their Qlik Sense Enterprise for Windows platform. With a CVSS score of 8.8, this vulnerability could allow attackers to escalate privileges and potentially execute arbitrary code on affected servers, posing a significant threat to data integrity and confidentiality. Check Point releases emergency fix for VPN zero-day exploited in attacks Date: 2024-05-29 Author: Bleeping Computer Check Point has released hotfixes for a VPN zero-day vulnerability exploited in attacks to gain remote access to firewalls and attempt to breach corporate networks. On Monday, the company first warned about a spike in attacks targeting VPN devices, sharing recommendations on how admins can protect their devices. Later, it discovered the source of the problem, a zero-day flaw that hackers exploited against its customers. NVD Leaves Exploited Vulnerabilities Unchecked Date: 2024-05-23 Author: Info Security Magazine A majority of currently exploited software vulnerabilities are missing from the US National Vulnerability Database (NVD), a new VulnCheck report has found. In the report published on May 23, the software security provider showed that 30 out of 59 known exploited vulnerabilities (KEVs) registered since February 12 have not yet been analyzed by the NVD team. In total, 50.8% of KEVs are missing critical metadata. More than half a billion customers' details reportedly stolen by notorious hacker Date: 2024-05-29 Author: 9News A notorious hacker has claimed to have stolen the personal data of more than half a billion Ticketmaster customers, likely including Australians. In a widely reported dark web post, hacker ShinyHunters claims to have 1.3 terabytes of data from 560 million global Ticketmaster and Live Nation customers, including names, emails, addresses, phone numbers and the last four digits of credit card numbers. The hacker is selling the data, which could potentially be used to commit identity theft and other types of fraud, for $US500 million (roughly $750 million). ESB-2024.3425.3 – Google Chrome CVSS (Max): 8.8 CISA added CVE-2024-5274 to its Known Exploited Vulnerabilities Catalog and advises users to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. ASB-2024.0035.3 – FortiSIEM Horizon3's Attack Team recently released a proof-of-concept (PoC) exploit and detailed a technical analysis related to CVE-2024-23109 and CVE-2024-23108 affecting FortiSIEM. AUSCERT advises all FortiSIEM 7.1.x users to promptly update to version 7.1.2 to prevent exploitation. ESB-2024.3470 – Citrix Workspace App for Mac CVSS (Max): 7.7 A critical flaw has been discovered in the Mac version of the Citrix Workspace app, which could enable attackers to escalate their privileges from a local authenticated user to a root user. Identified as CVE-2024-5027, this vulnerability presents a serious threat to individuals and businesses that depend on Citrix Workspace for their virtual app and desktop access requirements. ESB-2024.3525 – LenelS2 NetBox CVSS (Max): 9.8 Multiple vulnerabilities have been identified in LenelS2 NetBox. If exploited, these vulnerabilities could enable an attacker to bypass authentication and carry out harmful commands with heightened privileges. ESB-2024.3515 – Google Chrome CVSS (Max): None Google has rolled out an update with 11 security patches for its Stable channel. As a result of this update, the Stable channel has been upgraded to version 125.0.6422.141/.142 for Windows and Mac, and 125.0.6422.141 for Linux. Stay safe, stay patched and have a good weekend! The AUSCERT team

Learn more

Week in review

AUSCERT Week in Review for 24th May 2024

Greetings, What an amazing week it’s been at AUSCERT2024! This week was full of groundbreaking sessions, engaging workshops, and internationally renowned speakers. In addition to our great program of informative sessions, we also focused on important initiatives such as mental health, featuring several activities centred around uplifting mindfulness practices. To start their day, delegates enjoyed a morning stroll together in the Broadbeach sun, walking along the sand as the sun rose. We also offered puppy cuddles to lift attendees' spirits and had an onsite psychologist available for discussions on mental well-being and life coaching. Our "pay it forward" theme provided a platform for speakers to inspire the cyber security industry. Organisations are realising the importance of contributing to the growth and development of the community to propel it forwards. AUSCERT2024 featured keynote sessions by Piotr Kijewski, CEO of the Shadowserver Foundation, a prominent nonprofit dedicated to enhancing cyber security. The foundation is renowned for its comprehensive approach to improving internet security through data collection, analysis, and dissemination. Another highlight was keynote speaker Darren Kitchen, who presented on innovative implants and deceptive devices, equipping red teams around the world. HAK5, the platform he founded, is a significant contributor to the community, producing content that explores hacking tools and various cyber security topics to enhance collective knowledge. To top off a great week, we also released the Year in Review report! The year 2023 has been a period of remarkable achievements and developments. This comprehensive report highlights key successes, accomplishments, and projects undertaken by AUSCERT over the past year. From strategic initiatives and performance to market expansion and operational improvements, this review provides an in-depth analysis of our progress and sets the stage for our future endeavours. Critical GitHub Enterprise Server Flaw Allows Authentication Bypass Date: 2024-05-21 Author: The Hacker News [AUSCERT identified impacted members (where possible) and contacted them via email ] GitHub has rolled out fixes to address a maximum severity flaw in the GitHub Enterprise Server (GHES) that could allow an attacker to bypass authentication protections. Tracked as CVE-2024-4985 (CVSS score: 10.0), the issue could permit unauthorized access to an instance without requiring prior authentication. "On instances that use SAML single sign-on (SSO) authentication with the optional encrypted assertions feature, an attacker could forge a SAML response to provision and/or gain access to a user with administrator privileges," the company said in an advisory. Ivanti Patches Critical Code Execution Vulnerabilities in Endpoint Manager Date: 2024-05-22 Author: Security Week [AUSCERT utilized third-party search engines to identify and alert any impacted members] IT software company Ivanti on Tuesday announced patches for several products, including fixes for critical vulnerabilities in Endpoint Manager (EPM). Six out of the ten security defects resolved in EPM are critical-severity SQL Injection bugs that could allow an unauthenticated attacker on the network to execute arbitrary code, Ivanti says. Unauthenticated Attackers Can Hijack 400K+ WordPress Sites via Fluent Forms Bug (CVE-2024-2771) Date: 2024-05-20 Author: Security Online [AUSCERT utilized third-party search engines to identify and alert any impacted members] Fluent Forms, a popular WordPress plugin with over 400,000 active installations, has been found to contain multiple critical security vulnerabilities, leaving websites at risk of exploitation. The vulnerabilities, tracked as CVE-2024-4709, CVE-2024-2771, and CVE-2024-2782, range from cross-site scripting (XSS) to unauthorized access and privilege escalation, potentially allowing attackers to compromise websites and steal sensitive data. Atlassian Patches RCE Flaw in Confluence Data Center and Server Date: 2024-05-21 Author: Security Online [AUSCERT identified the impacted members (where possible) and contacted them via email] Atlassian, a leading provider of collaboration and productivity software, has urgently addressed a remote code execution (RCE) vulnerability in its Confluence Data Center and Server products. Tracked as CVE-2024-21683, this flaw could allow authenticated attackers to seize control of affected systems, potentially leading to data breaches and operational disruptions. Veeam warns of critical Backup Enterprise Manager auth bypass bug Date: 2024-05-21 Author: Bleeping Computer [AUSCERT utilized third-party search engines to identify and alert any impacted members] Veeam warned customers today to patch a critical security vulnerability that allows unauthenticated attackers to sign into any account via the Veeam Backup Enterprise Manager (VBEM). VBEM is a web-based platform that enables administrators to manage Veeam Backup & Replication installations via a single web console. It helps control backup jobs and perform restoration operations across an organization's backup infrastructure and large-scale deployments. ESB-2024.3251 – VMware Products CVSS (Max): 8.1 VMware has issued a security advisory to address vulnerabilities in multiple VMware products. These vulnerabilities, if exploited, could enable attackers to run malicious code on host systems from within a virtual machine, presenting significant security threats to numerous organizations globally. ESB-2024.3252 – Atlassian Products CVSS (Max): 9.8 Atlassian has identified numerous vulnerabilities in its range of products, comprising 35 high-severity vulnerabilities and 2 critical-severity vulnerabilities. These issues have been addressed and resolved in the latest versions of the products. ESB-2024.3232 – Google Chrome CVSS (Max): None Google has introduced a Chrome 125 update that addresses six vulnerabilities, including four high-severity bugs identified by external researchers. The most recent Chrome release is currently being distributed as version 125.0.6422.76 for Linux, and as versions 125.0.6422.76/.77 for Windows and macOS. ESB-2024.3354 – Cisco Firepower Management Center (FMC) CVSS (Max): 8.8 A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could enable an authenticated, remote attacker to carry out SQL injection attacks on a compromised system. This issue arises due to inadequate validation of user input within the web-based management interface. Stay safe, stay patched and have a good weekend! The AusCERT team

Learn more