December 16, 2023 - Red N Security

Hello all,

Happy Patch Tuesday week! As with past years, Microsoft released fewer updates this month than in prior months, but Adobe thought that it should provide a holiday gift to make up the difference and released patches for 207 items. A few other vendors follow the same cycle, so be sure to check your products for any updates.

The volume of news and other can appear overwhelming, the best strategy is to read the Notable Callouts below and then skim the full list of linked news item titles that follow for things that pertain to you or your environment or simply interest you, and then selecting them for more information. So, let’s get to it. And don’t forget, our site, https://red-n-security.com also has searchable archives of past newsletters.

Notable Callouts:

Adobe starts the headlines with 207 updates for a number of their products. This time Acrobat was not included, but a good number of their other items were. Make sure you check your Adobe software for updates.
Apple released emergency updates for actively exploited items in some older devices this week, and they released security updates for critical items in iOS and macOS for the rest of the iFruit ecosystem.
Microsoft didn’t overwhelm this month, as expected, but there is at least one rather severe item, an MSHTML vulnerability that should be patched sooner than later as simply receiving a specially crafted email (if it passes your filters) can trigger this exploit. One zero-day for AMD processors, that was announced earlier was also patched this month by Redmond’s warriors.
Sophos, in a smart marketing and good internet citizen move, made patches available for actively exploited RCE attacks on unsupported firewalls. Hopefully, the admins for these vulnerable firewalls take notice and plug the holes via Sophos’ early Christmas gift.

In Ransomware, Malware, and Vulnerabilities News:

Log4Shell/Log4j is still being exploited by threat actors, nearly two years after the pants-on-fire vulnerability was revealed. A surprising statistic shows that almost 25% of apps are still vulnerable to this flaw. The Lazarus Group is actively using it to install Remote Access Trojans onto vulnerable systems.
North Korea’s Lazarus criminals are responsible for nearly 20% of the world’s crypto losses. That’s staggering! One dirt-speck oppressive regime is behind every 5th successful crypto theft.

In Other News Events of Note and Interest:

Linux kernel 6.6.6 released to fix a WiFi regression issue. Linux versions have traditionally released with interesting names such as Laughing Rebecca, or Bookworm. I choose to dub this one Lucifer’s Deadlock Daemon. Alas, the daemonic numerological anomaly ended a few days later when version 6.6.7 was released with 268 files updated.
VMware Fusion Blog announced that, as suspected, they are moving to a subscription model. Perpetual licenses are now extinct. It does appear that VMware Player and Fusion Player will still be free of charge. As of this writing, I’m uncertain if the ESXi version of VMware will remain free.

In Cyber Insurance News:

Does Pentesting Actually Save You Money On Cyber Insurance Premiums? The article gives good information about what drives costs and affirms that good Pentesting can in fact save you money on premiums.

As many organizations prepare for a slowdown at the end of the calendar year, it is vital to remain vigilant. Malevolent dirt-bags, intent on doing your company harm ramp up their sleazy ways during this season, expecting that defenders will be taking much needed breaks. Make sure that things are buttoned up, and somebody is minding the store before you step away to participate in this season’s festivities.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Cyber Insurance News