Hendry Adrian’s Post

“Our goal is to eliminate Patch Tuesdays. Essentially you’re always staying ahead of your threats and your vulnerabilities by leveraging Tanium’s Autonomous Endpoint Management to do that.” - #Tanium CEO Dan Streetman More on how #TaniumAEMI is helping cut the risks of breaches with patch management.

July's Security Landscape blog from Martin Beauchamp looks at cryptographic and software bills of materials, GSMA’s Mobile Threat Intelligence Framework and physical #security threats to critical infrastructure 🔊 Read now 👇 #MobileSecurity #NetworkSecurity

Palo Alto Networks warns of 6 security vulnerabilities in Expedition Palo Alto Networks has issued a warning to its customers regarding six security vulnerabilities found in its Expedition solution. These vulnerabilities, if exploited, can allow attackers to hijack PAN-firewalls and access sensitive data, including user credentials and device configurations. The flaws include command injection, reflected cross-site scripting, cleartext storage of sensitive information, missing authentication, and injection vulnerabilities. Horizon3.ai vulnerability researcher Zach Hanley discovered and reported four of the bugs, along with a proof-of-concept exploit that chains two vulnerabilities to gain arbitrary command execution on vulnerable Expedition servers. Palo Alto Networks has released fixes for all listed issues in Expedition 1.2.96 and later versions, urging users to upgrade and rotate all usernames, passwords, and keys. Admins who are unable to deploy the security updates immediately are advised to restrict Expedition network access to authorized users, hosts, or networks. Despite the severity of the vulnerabilities, there is currently no evidence of exploitation in attacks.

“Our goal is to eliminate Patch Tuesdays. Essentially you’re always staying ahead of your threats and your vulnerabilities by leveraging Tanium’s Autonomous Endpoint Management to do that.” - #Tanium CEO Dan Streetman More on how #TaniumAEMI is helping cut the risks of breaches with patch management.

Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) Palo Alto Networks has released workaround guidance for a command injection vulnerability (CVE-2024-3400) affecting PAN-OS versions 10.2, 11.0, and 11.1. Palo Alto Networks has reported active exploitation of this vulnerability in the wild. Operation MidnightEclipse, which involves a critical command injection vulnerability in Palo Alto Networks PAN-OS software, identified as CVE-2024-3400. The vulnerability, which allows unauthenticated attackers to execute arbitrary code with root privileges, affects PAN-OS versions configured with GlobalProtect gateway or portal and device telemetry enabled1. The brief includes information on the vulnerability’s scope, post-exploitation activity, interim guidance, and mitigation strategies, such as applying hotfix releases and enabling Threat ID 95187. It also discusses the Unit 42 Managed Threat Hunting queries and indicators of compromise related to the UPSTYLE backdoor and command and control infrastructure used in the attacks. Users are advised to refer to the Palo Alto Networks Security Advisory for detailed remediation guidance. https://lnkd.in/g8C6CYHQ

“Our goal is to eliminate Patch Tuesdays. Essentially you’re always staying ahead of your threats and your vulnerabilities by leveraging Tanium’s Autonomous Endpoint Management to do that.” - #Tanium CEO Dan Streetman More on how #TaniumAEMI is helping cut the risks of breaches with patch management.

“Our goal is to eliminate Patch Tuesdays. Essentially you’re always staying ahead of your threats and your vulnerabilities by leveraging Tanium’s Autonomous Endpoint Management to do that.” - #Tanium CEO Dan Streetman More on how #TaniumAEMI is helping cut the risks of breaches with patch management.

Palo Alto Networks has shared more details of a critical security flaw impacting PAN-OS that has come under active exploitation in the wild by malicious actors. The company described the vulnerability, tracked as CVE-2024-3400 (CVSS score: 10.0), as "intricate" and a combination of two bugs in versions PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 of the software. "In the first one, the GlobalProtect service did not sufficiently validate the session ID format before storing them. This enabled the attacker to store an empty file with the attacker's chosen filename," Chandan B. N., senior director of product security at Palo Alto Networks, said. "The second bug (trusting that the files were system-generated) used the filenames as part of a command." It's worth noting that while neither of the issues are critical enough on their own, when chained together, they could lead to unauthenticated remote shell command execution. Palo Alto Networks said that the threat actor behind the zero-day exploitation of the flaw, UTA0218, carried out a two-stage attack to achieve command execution on susceptible devices. The activity is being tracked under the name Operation MidnightEclipse. More details in The Hacker News story below!

Ivanti has released patches to address multiple critical security vulnerabilities in its Endpoint Manager (EPM) that could be exploited to achieve remote code execution under certain conditions. Six of the ten vulnerabilities—designated CVE-2024-29822 through CVE-2024-29827, with CVSS scores of 9.6—are SQL injection flaws that allow an unauthenticated attacker within the same network to execute arbitrary code. The remaining four vulnerabilities—CVE-2024-29828, CVE-2024-29829, CVE-2024-29830, and CVE-2024-29846, each with CVSS scores of 8.4—require the attacker to be authenticated to exploit similar flaws.

Multiple attacks exploit vulnerabilities in an IT remote access tool to deliver a variety of different payloads into business environments - https://lnkd.in/eb2G2P5E