November 16, 2024 - Red Dot Security

Hello all,

Tuesday saw the monthly cavalcade of patches to fix bugs, defects and flaws from a good number of vendors. Additionally, this past week saw a significant quantity of non-scheduled warnings and updates. If you’re thinking that there seems to be an ever-increasing slew of these being pushed out, you’re not alone. The “Five Eyes Alliance” of U.S., U.K., Australia, Canada and New Zealand have announced that increasing numbers of zero-day vulnerabilities being exploited is “the new normal”, and NIST reports that it is still struggling to catch up from a massive backlog of vulnerabilities reported to them. So, as we get onto the headlines of the week, Manent Semper Vigilans!

As usual, my commentary is followed by a plethora of links to other items that are worth skimming to see if they interest you or pertain to your particular environment or of those you support.

Headline NEWS:

Citrix starts our list with about a dozen defects in a handful of products requiring patching. A few of these are already being exploited, so don’t wait.
CrushFTP is a cross-platform SFTP program that I discovered several years ago. It is feature rich and works very well. They just released a patch for a defect involving password resets that could allow someone to take over the system. The vendor advises “update immediately to 10.8.3+ or v11.2.3+” – referring to version numbers.
Fortinet continues to roll out fixes on a regular basis. It would be nice if they didn’t have to release them so frequently, but at least they do patch the holes when they find them. This time there is a defect in their VPN app that could allow for Privilege Escalation and malware insertion. So far there is no evidence of active exploitation, but with any firewall flaw, it is only a matter of time.
IBM and AMD have both released patches for their products. There’s quite a few of them, so check if you’re affected.
Ivanti dropped a rather hefty load of patches, plugging at least 50 different vulnerabilities across Endpoint Manager, Avalanche, Connect Secure, Policy Secure, and Secure Access Client. This company’s defects are especially sought after by evil cybercriminals, patch fast.
Microsoft unleashed 89 fixes for their products on Tuesday last week, with at least two of them being zero-days in active exploitation. Vet quickly and update.
Palo Alto Networks is back in the headlines. Last week there was a “potential Remote Code Execution (RCE) vulnerability in their Pan-OS”. That has now been confirmed. There is no patch yet. However, last week’s mitigation guidance remains the same – “block access from the Internet to their firewalls’ PAN-OS management interface and only allow connections from trusted internal IP addresses.”
Veeam has released an updated version of an earlier patch for a “high-severity vulnerability in Backup Enterprise Manager that could be exploited remotely, without authentication”. Apply the hotfix as soon as possible.

In Ransomware, Malware, and Vulnerabilities News:

China continues to dominate tech news, mostly for bad reasons. For the past couple of weeks there have been increasing reports from various news outlets and three- and four-letter agencies of breaches into US telecom provider’s networks. Additionally, news outlets are starting to notice that China has a massive army of very well trained and disciplined cyber attackers that are actively engaged in electronic warfare against – well – everyone else.

In Other News Events of Note and Interest:

The United Nations is getting ready to adopt a new Cybercrime Convention. This treaty would define cybercrime, malicious activity, hacking, and intrusion. However, there is little exception being considered for ethical hacking and security research. This could have a chilling effect on countries that adopt the convention wholescale without enacting protections. This is definitely one to watch lest it slip under the radar and criminalize the good guys.

In Cyber Insurance News:

Insurance Firm Introduces Liability Coverage for CISOs describes a looming issue for many of these C-Suite defenders – being held liable for breaches and successful attacks against companies they support. The article notes that “38% of CISOs are not covered under their organizations’ corporate director and officer insurance (D&O) policies and 18% not knowing if they’re covered.” The insurer in this article provides personal liability coverage for these cyber warriors.

Musings:

The Chinese hacks into our telecommunication carriers shows that the attack-surface is continuing to get ever more personal, necessitating that we evolve our behaviors to help combat this threat. Our National Security Agency has renewed their call for the public to restart their phones at least once per week. Apple’s new iOS18 reboots phones automatically if they haven’t been unlocked in 72 hours. Hmm, what does Apple know that we don’t? I think that we might want to heed the NSA’s advice.

Headline NEWS

Ransomware, Malware, and Vulnerabilities News

Other News Events of Note and Interest

Cyber Insurance News

Like this: