Security Flaws & Fixes - W/E - 10/3/19
CISA: Vulnerable Interpeak IPnet TCP/IP Stack Affects More Medical, Industrial Devices (10/02/2019)
The Cybersecurity and Infrastructure Security Agency (CISA) is aware of a public report detailing vulnerabilities found in the Interpeak IPnet TCP/IP stack. The Interpeak IPnet stack vulnerabilities were first reported in Wind River VxWorks but the bugs have expanded beyond the affected VxWorks systems and affect additional real-time operating systems. CISA has reached out to affected vendors of the report and asked them to confirm the vulnerabilities and identify mitigations. CISA issued an advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks. The following vendors have issued their own advisories: BD, Drager, GE Healthcare, Philips Healthcare, and Spacelabs.
The Cybersecurity and Infrastructure Security Agency (CISA) is aware of a public report detailing vulnerabilities found in the Interpeak IPnet TCP/IP stack. The Interpeak IPnet stack vulnerabilities were first reported in Wind River VxWorks but the bugs have expanded beyond the affected VxWorks systems and affect additional real-time operating systems. CISA has reached out to affected vendors of the report and asked them to confirm the vulnerabilities and identify mitigations. CISA issued an advisory to provide early notice of the reported vulnerabilities and identify baseline mitigations for reducing risks to these and other cybersecurity attacks. The following vendors have issued their own advisories: BD, Drager, GE Healthcare, Philips Healthcare, and Spacelabs.
Cisco Addresses Multiple Security Issues with Batch of Advisories (10/01/2019)
Cisco released multiple advisories to address vulnerabilities and security issues across its product lines. The issues include command injection, buffer overflow, denial-of-service, and unauthorized access vulnerabilities, among others. IOS XE Software, Email Security Appliance, and Catalyst 4000 Series Switches are among the products affected.
Cisco released multiple advisories to address vulnerabilities and security issues across its product lines. The issues include command injection, buffer overflow, denial-of-service, and unauthorized access vulnerabilities, among others. IOS XE Software, Email Security Appliance, and Catalyst 4000 Series Switches are among the products affected.
Moxa EDR-810 Routers Require Security Update (10/02/2019)
Moxa's EDR-810 Series routers are affected by improper input validation and improper access control vulnerabilities. Users should immediately update to version 5.2 to mitigate risks. The vendor posted an advisory with further details.
Moxa's EDR-810 Series routers are affected by improper input validation and improper access control vulnerabilities. Users should immediately update to version 5.2 to mitigate risks. The vendor posted an advisory with further details.
NSA's Ghidra Tool Vulnerable to Code Execution (10/02/2019)
The NIST posted an advisory for the National Security Agency's (NSA) reverse-engineering Ghidra tool due to a vulnerability that could enable an attacker to launch code in vulnerable systems. All versions are affected and no fix is yet available.
The NIST posted an advisory for the National Security Agency's (NSA) reverse-engineering Ghidra tool due to a vulnerability that could enable an attacker to launch code in vulnerable systems. All versions are affected and no fix is yet available.
PDFex Attacks Bypass Encryption to Exfiltrate Info from PDF Documents (10/02/2019)
Security researchers at Ruhr University Bochum discovered severe weaknesses in the PDF encryption standard which leads to full plaintext exfiltration in an active attacker scenario. The vulnerabilities, dubbed "PDFex," are explained as: an attacker possessing an encrypted PDF file can manipulate parts of it even without knowing the corresponding password and since PDF encryption uses the Cipher Block Chaining (CBC) encryption mode without integrity checks, self-exfiltrating ciphertext parts using CBC malleability gadgets can be created. Twenty-seven desktop and browser PDF viewers are affected.
Security researchers at Ruhr University Bochum discovered severe weaknesses in the PDF encryption standard which leads to full plaintext exfiltration in an active attacker scenario. The vulnerabilities, dubbed "PDFex," are explained as: an attacker possessing an encrypted PDF file can manipulate parts of it even without knowing the corresponding password and since PDF encryption uses the Cipher Block Chaining (CBC) encryption mode without integrity checks, self-exfiltrating ciphertext parts using CBC malleability gadgets can be created. Twenty-seven desktop and browser PDF viewers are affected.
PHP Vulnerability Can Lead to Arbitrary Code Execution (10/01/2019)
The Multi-State Information Sharing & Analysis Center (MS-ISAC) released an advisory to warn of a vulnerability in PHP, which could allow an attacker to execute arbitrary code. PHP supports a wide variety of platforms and is used by numerous Web-based software applications. Successfully exploiting this vulnerability could allow for arbitrary code execution in the context of the affected application. It is best to upgrade to the latest PHP version immediately.
The Multi-State Information Sharing & Analysis Center (MS-ISAC) released an advisory to warn of a vulnerability in PHP, which could allow an attacker to execute arbitrary code. PHP supports a wide variety of platforms and is used by numerous Web-based software applications. Successfully exploiting this vulnerability could allow for arbitrary code execution in the context of the affected application. It is best to upgrade to the latest PHP version immediately.
Update Exim Email Servers to Alleviate System Crash (10/01/2019)
Tenable's researchers say that a heap-based buffer overflow vulnerability in Exim email servers, could allow remote attackers to crash Exim or potentially execute arbitrary code. Over 3.5 million systems are vulnerable, according to Tenable's analysis. The Exim team released version 4.92.3 on September 29 to address this bug.
Tenable's researchers say that a heap-based buffer overflow vulnerability in Exim email servers, could allow remote attackers to crash Exim or potentially execute arbitrary code. Over 3.5 million systems are vulnerable, according to Tenable's analysis. The Exim team released version 4.92.3 on September 29 to address this bug.
Updates for iOS and watchOS Released by Apple (10/01/2019)
Apple released updates for iOS and watchOS. Users should immediately update to mitigate risks.
Apple released updates for iOS and watchOS. Users should immediately update to mitigate risks.
WhatsApp Patch Fixes RCE Condition (10/03/2019)
A double-free vulnerability in WhatsApp for Android can result in a remote code execution, according to the researcher who discovered it. The issue was reported to Facebook and the bug was patched in WhatsApp version 2.19.244.
A double-free vulnerability in WhatsApp for Android can result in a remote code execution, according to the researcher who discovered it. The issue was reported to Facebook and the bug was patched in WhatsApp version 2.19.244.
Yokogawa Products Prone to Cyber Attacks (10/02/2019)
Yokogawa's Exaopc, Exaplog, Exaquantum, Exasmoc, Exarqe, GA10, and InsightSuiteAE products are impacted by an unquoted search path or element, according to an advisory posted by the Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability may allow a local attacker to execute malicious files by the service privilege. Countermeasures are documented in the advisory.
Yokogawa's Exaopc, Exaplog, Exaquantum, Exasmoc, Exarqe, GA10, and InsightSuiteAE products are impacted by an unquoted search path or element, according to an advisory posted by the Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability may allow a local attacker to execute malicious files by the service privilege. Countermeasures are documented in the advisory.