Dmitry Kurbatov

Weekly Vulnerability Roundup (Week Commencing: 7th October 2024) We’re back again with the Weekly Vulnerability Roundup. This report covers any vulnerabilities which have had an EPSS score change of at least 10% and any new additions to the CISA Known Exploited Vulnerabilities catalogue. A new addition to this week’s report is that we’ve added the original EPSS score to add more context to the deltas. Want to receive this report and future reports right to your inbox every Friday? Enter your email address here to sign up: https://lnkd.in/gyU9QYgx See the summary of affected technologies below and read the FULL report on our blog here: https://lnkd.in/gfa5qm3y Total CVEs:  31 References: EPSS by FIRST: https://www.first.org/ CISA KEV: https://lnkd.in/gRGpREQS Penetration Testing and SOC: https://lnkd.in/gMQXZrTs

12

The latest update for #Trustwave includes "UK Must Prioritize #Cybersecurity Governance Amidst Rising Threat of Cybercrime" and "7-Step Guide to Properly Scoping an Offensive Security Program". #MDR #infosec #ThreatIntelligence https://lnkd.in/dAFsV2s9

1

#Outsourced #SOC: 24x7 Advantage Offers a path that combines security and savings, Wednesday Podcast   “The starting point of the SOC is team of Triage staff,” says Michelle Fiegehen of 24x7 Advantage. “These analysts review raw data and respond to alerts. They configure and tweak the parameters of monitoring tools to minimize false threats, as well as responding to and resolving actual incidents promptly. This tier of activity is the easiest to outsource and integrate with an in-house SOC and reduces the risk of alert-fatigue on more senior and expensive in-country resources.”   In this short 24x7 Advantage Wednesday Podcast, we learn how a SOC can be expensive. However, the expensive bits might also be the places where savings might be found. 24x7 Advantage offers a set of services that enable companies to focus on other needs. Outsourced SOC could reduce costs and it might also be a channel opportunity. “24x7 Advantage can also provide Incident Responders and Threat Hunters or SME’s but we recommend the #MSP starts with the triage level,” adds Michelle.   ✍ Blog: https://lnkd.in/gwxhtCm2 📩vEmail web version: https://lnkd.in/gfu64_2Z more from last week... ✍ Blog: https://lnkd.in/gfXvPktz 📩 Email web version: https://lnkd.in/g64YMtjz 💡 Learn more at www.24x7advantage.com   The #Wednesday #Morning #MSP #Podcast ideas for MSPs.... TR Publications Michelle Fiegehen David Jooste Charlene Ignacio Evan Kirstel B2B TechFluencer Julie Smith Marc Magliano Tracy Venters Jeff KAGAN Bill (PhoneBill) McClain #ccaas #ucaas #cpaas #whitelabel

6

Security issues love to surface in groups: Multiple vulnerabilities discovered in Siemens Energy automation products https://lnkd.in/d39DWPSt 👉 CVE-2024-31484: Buffer Overread 👉 CVE-2024-31485: Privilege Escalation 👉 CVE-2024-31486: Unsafe Storage of MQTT Passwords Good work on this OT assessment Stefan Viehböck, Steffen Robertz, Gerhard Hechenberger, Constantin Schieber-Knöbl Current regulations and #infosec laws can be overwhelming. But it is not your job alone to ensure ongoing compliance. It is ours, to do the heavy lifting for you. Get in touch with one of our security experts to find out if you already meet #NIS2 requirements or not 👉 #infosec #automation #teamsecconsult

21

🚨 Critical SSRF vulnerability in Apache IoTDB Workbench A critical Server-Side Request Forgery (SSRF) vulnerability has been discovered in Apache IoTDB Workbench version 0.13.x. Identified as CVE-2024-36448, this vulnerability poses significant risks to the confidentiality, integrity and availability of affected systems. It has been classified under CWE-918. The SSRF vulnerability allows an attacker to manipulate an unknown input, causing the web server to send a request to an unintended destination. This can lead to unauthorized access to sensitive data, data corruption and potential service disruption. This vulnerability impacts : --> confidentiality by allowing unauthorized access to sensitive information, --> integrity by enabling potential modification or corruption of data, --> availability by causing possible service degradation or denial of service. Since Apache IoTDB Workbench is no longer supported, users are advised to: --> find and migrate to a supported and secure alternative, -->limit access to trusted users only. 🔍Technical information -> CVE: CVE-2024-36448 -> CWE: CWE-918 -> Affected versions: Apache IoTDB Workbench 0.13.x -> Publication date: August 5, 2024 -> Discovered by: L0ne1y -> License: open source Implementing Secure by Design principles can significantly mitigate the risk of SSRF vulnerabilities. These principles involve integrating security measures into the design and architecture of software from the outset. Here are a few strategies: --> ensure all inputs are strictly validated and sanitized before processing ; --> implement strong access controls to restrict the ability of components to make external requests ; --> use a whitelist approach to limit the URLs that the server can request, ensuring only trusted and necessary destinations are reachable ; --> isolate critical components to minimize the impact of any successful SSRF attack (network segmentation). The SSRF vulnerability in Apache IoTDB Workbench proves how important it is to keep software updated and supported. To protect systems from vulnerabilities, we need to be proactive about cybersecurity and avoid using outdated or unsupported software. 🛡️ Remain vigilant and safeguard the confidentiality, integrity and availability of systems. Contact us for an innovative solution to integrate Secure by Design into your development processes. Source https://lnkd.in/dkQdKWy9 https://lnkd.in/dzcWM9ie https://lnkd.in/dXrHn55N

8

SOHO (small-office and home-office) PROTECTION The UK has previously identified APT40 (Advanced Persistent Threat 40) as part of the Chinese Ministry of State Security and it is this cyber threat group that is now targeting SoHo devices, which are often more vulnerable. These devices are easier to exploit when they lack the latest software updates or security patches, making it simpler to hide malicious activity and can be a backdoor route to bigger targets. Protecting SoHo devices involves a multi-layered approach to safeguard against various threats. Here are some key steps you can take to enhance your security: https://lnkd.in/eT4cksTj https://lnkd.in/eJMQGYC7 IT Security Services #cybersecurity #itsecurityoperations #itsecurity #SOC

14

🚨 Security Advisory: Important CVEs Disclosed 🚨 Hi Envoy Community, We would like to inform you about the following Common Vulnerabilities and Exposures (CVEs) identified in Envoy: 🔒 CVE-2024-45807: oghttp2 crash on OnBeginHeadersForStream 🔒 CVE-2024-45808: Malicious log injection via access logs 🔒 CVE-2024-45806: Potential manipulation of x-envoy headers from external sources 🔒 CVE-2024-45809: JWT filter crash in the clear route cache with remote JWKs 🔒 CVE-2024-45810: Envoy crashes for LocalReply in HTTP async client 🔧 Resolutions Coming Soon: These issues will be addressed in the following Envoy releases: - v1.31.2 - v1.30.6 - v1.29.9 - v1.28.7 🔗 Release Information: The updates will be available on our Releases Page starting today. 📖 Documentation: For detailed guidance, please refer to our Envoy Documentation. 🔄 Upgrade Recommendation: We strongly encourage all users to update to the latest versions of Envoy to ensure security and stability. 🔍 Ongoing Improvements: A pull request addressing these vulnerabilities has been initiated on the main branch. Thank you for your attention and continued support. ♻ REPOST this to help other Envoy users stay on top of Envoy News. #EnvoyProxy #Kubernetes #Security #CVE #DevOps #CloudNative #OpenSource #CyberSecurity

6

FREE Webinar - Understand Your Attackers: The Role of Sandboxing in Threat Intelligence 11 July | 1 pm BST Join us and VMRay and learn how to integrate sandboxing technologies into your threat intelligence workflows, enabling a transition from reactive response measures to proactive defense strategies! Register here: https://ow.ly/pH5T50StTVp

80

New Post: #CISA and @FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory #Traversal Vulnerabilities - https://lnkd.in/dAir6seU CISA and FBI Release Secure by Design Alert to Urge Manufacturers to Eliminate Directory Traversal Vulnerabilities 05/02/2024 02:00 PM EDT Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Secure by Design Alert, Eliminating Directory Traversal Vulnerabilities in Software. This Alert was crafted in response to recent well-publicized threat actor campaigns that exploited directory traversal vulnerabilities in software (e.g., CVE-2024-1708, CVE-2024-20345) to compromise users of the software—impacting critical infrastructure sectors, including the Healthcare and Public Health Sector. Additionally, this Alert highlights the prevalence, and continued threat actor exploitation of, directory traversal defects. Currently, CISA has listed 55 directory traversal vulnerabilities in our Known Exploited Vulnerabilities (KEV) catalog. Approaches to avoid directory traversal vulnerabilities are known, yet threat actors continue to exploit these vulnerabilities which have impacted the operation of critical services, including hospital and school operations. CISA and the FBI urge software manufacturer executives to require their organizations to conduct formal testing to determine their products’ susceptibility to directory traversal vulnerabilities. For more information on recommended principles and best practices to achieve this goal, visit CISA’s Secure by Design page. To catch up on the publications in this series, visit Secure by Design Alerts. Robert Williams#News247WorldPress

1

ISMG editors discussed the strategic convergence of data security posture management and data loss prevention #technologies, evolving priorities of security leaders and the urgent readiness challenges posed by the NIS2 Directive. Watch: https://lnkd.in/d5i6Xakm #ISMGNews #cybersecurity Anna Delaney Tony Morbin Tom Field Michael Novinson

11

🌩️ ‘Salt Typhoon’ Attack on Telecom Infrastructure Continues One of the most intriguing and concerning topics last month is the cyberattacks attributed to the Chinese group Salt Typhoon. This group breached U.S. wiretap systems and networks of major telecom companies. Reports suggest the attackers may have been present for months, with investigations still unfolding. Over the weekend, T-Mobile confirmed it was also affected. 💥 Current Status: To date, AT&T, Verizon, Lumen, and now T-Mobile have all been identified as victims of this campaign. The attack, attributed to Salt Typhoon (also known as Earth Estries and Ghost Emperor) specifically targeted wiretap systems installed for law enforcement purposes within these telecom networks. 🔓 The Ripple Effect: Some agencies are now advising their employees to limit the use of cellphones for work due to the risks associated with China-linked telecom intrusions. This raises critical questions about the security and reliability of telecom networks, which are not as robust or resilient as we would expect them to be. While we may see more officials recommending reduced use of phones for sensitive communications, the question remains: 🔸What’s the next step? 🔸Should everyone switch to encrypted apps like Signal? 🔸Or is a broader overhaul of telecom infrastructure security the answer? What do you think? 💭 #CyberSecurity #TelecomSecurity #SaltTyphoon #HackingNews

206

28 Comments