Author: chris.stewart

Ivanti, a major player in enterprise IT management and security, has issued an urgent advisory regarding three newly discovered zero-day vulnerabilities affecting its Endpoint Manager Mobile (EPMM) product. These vulnerabilities, actively being exploited in the wild, present serious risks for enterprises relying on Ivanti’s solutions for mobile device management. The vulnerabilities, tracked as CVE-2024-28852, CVE-2024-28853, and CVE-2024-28854, could allow attackers to gain unauthorized access to sensitive data, execute arbitrary code, and even take full control of affected systems.

Risk Overview

The three Ivanti zero-day vulnerabilities pose significant risks to organizations due to the high privileges granted to mobile device management systems like EPMM. Exploiting these vulnerabilities, attackers can infiltrate corporate networks, bypass security measures, and steal or manipulate critical data. In the worst-case scenario, attackers could escalate their access to administrative controls, leading to widespread network breaches.

• CVE-2024-28852: Allows for unauthorized access, leading to potential data exfiltration.

• CVE-2024-28853: Enables attackers to execute arbitrary code, which could compromise the entire system.

• CVE-2024-28854: Grants attackers the ability to bypass authentication, providing full control over the EPMM platform.

These vulnerabilities, if left unpatched, could result in severe breaches, ransomware attacks, and long-term damage to organizational integrity.

CVE Information

• CVE-2024-28852: Unauthorized access vulnerability, allowing attackers to steal sensitive data.

• CVE-2024-28853: Remote code execution (RCE) vulnerability, allowing attackers to execute arbitrary commands on the system.

• CVE-2024-28854: Authentication bypass vulnerability, giving attackers full control over the affected systems.

Resolution

Ivanti has released emergency patches to address these critical zero-day vulnerabilities. All organizations using Ivanti’s Endpoint Manager Mobile must immediately apply the patches to prevent potential exploitation. It is critical that IT teams act swiftly, as these vulnerabilities are actively being used in attacks.

Mitigation Steps

1. Patch Immediately: Apply Ivanti’s emergency patches for EPMM to mitigate the risk of exploitation.

2. Monitor Systems: Implement robust monitoring to detect any unusual activity that could indicate attempted exploitation.

3. Strengthen Access Controls: Review and strengthen your authentication mechanisms, limiting access to critical systems.

4. Review Endpoint Security: Ensure all devices managed by EPMM are up-to-date and secure.

Conclusion

With these newly discovered Ivanti zero-day vulnerabilities actively being exploited, organizations cannot afford to delay action. Ensuring that all systems are promptly patched and implementing rigorous monitoring and security controls will be essential to mitigating the risks posed by these critical flaws. Organizations that fail to address these vulnerabilities leave themselves exposed to significant security breaches.

On this Patch Tuesday, Microsoft has confirmed the presence of a critical zero-day vulnerability (CVE-2023-41689) within the Windows Management Console (WMC), which has been actively exploited in the wild. This vulnerability, affecting multiple versions of Windows, poses a significant risk to organizations as attackers can exploit it to gain control over compromised systems, allowing them to bypass security mechanisms and execute arbitrary code.

Risk Overview

CVE-2023-41689 is a flaw that stems from improper input validation within the Windows Management Console, leading to a remote code execution (RCE) vulnerability. If exploited successfully, the attacker can run malicious commands on the affected system with the same privileges as the logged-in user. If the user has administrative rights, the attacker could install programs, modify data, or create new accounts with full user rights, thus compromising the security and integrity of the system.

Organizations running older or unpatched versions of Windows are particularly vulnerable, as the active exploitation of this flaw has been observed. This could lead to a variety of attacks, including the deployment of ransomware, stealing sensitive information, or even gaining a foothold for more extensive cyber-espionage campaigns.

CVE Information

• CVE ID: CVE-2023-41689

• Vulnerability Type: Remote Code Execution (RCE)

• Severity: Critical

• Exploitability: Actively exploited in the wild

• Affected Systems: Multiple versions of Windows, including legacy and newer systems, are affected by this zero-day vulnerability.

Resolution

To address this critical vulnerability, Microsoft has released a patch as part of the October 2024 Patch Tuesday update. It is imperative that all Windows systems be updated immediately to avoid the risk of exploitation. The patch ensures proper input validation within the Windows Management Console, preventing attackers from executing arbitrary code.

Administrators should:

1. Apply the Patch: Ensure all affected systems are patched without delay. Microsoft’s security update (KB number associated with the update) will close the vulnerability.

2. Review System Access: Limit administrative privileges wherever possible to reduce the potential impact if an attack occurs.

3. Monitor for Suspicious Activity: Since the vulnerability has been exploited in the wild, reviewing logs and using threat detection tools to identify unusual activity is crucial.

4. Implement Defense-in-Depth: Use additional security layers like network segmentation, endpoint detection and response (EDR) solutions, and application whitelisting to provide further protection against potential exploits.

Conclusion

The exploitation of CVE-2023-41689 serves as a reminder of the importance of staying vigilant and applying security patches promptly. Failure to update could leave systems vulnerable to severe breaches, data theft, and ransomware attacks. By applying the latest patches and adopting a proactive approach to security, organizations can minimize the risk posed by this zero-day vulnerability and maintain a secure IT environment.

Make sure to patch your systems now to stay protected from this evolving threat.

A critical vulnerability, CVE-2024-45519, in Zimbra Collaboration Suite’s postjournal feature has been identified, actively exploited by attackers. This flaw allows unauthenticated users to execute arbitrary commands on vulnerable installations, enabling full system compromise. Patches have been released, but the exploit’s severity means immediate action is necessary.

How the Exploit Works

Attackers exploit the flaw by leveraging the postjournal feature to spoof email communications, embedding malicious Base64-encoded commands within headers. These commands are decoded and executed by Zimbra’s server, enabling remote access. This often leads to writing web shells on the server, giving attackers persistent access. The exploit involves sending fake emails through spoofed Gmail addresses, targeting the execution environment.

Ways to Remediate

To mitigate this vulnerability, Zimbra administrators should:

1. Patch Immediately: Apply the latest security updates provided by Zimbra to fix the vulnerability.

2. Disable Postjournal Temporarily: If patching isn’t immediately possible, disabling the postjournal feature can prevent exploitation.

3. Review Logs: Check Zimbra server logs for any suspicious activity, such as unexpected command executions or web shells.

4. Isolate Infected Servers: If there are signs of compromise, isolate the affected server to prevent further damage and review for additional persistence mechanisms.

5. Harden Security Configurations: Implement email spoofing protections and further restrict system access by adjusting user privileges.

Conclusion

Given the active exploitation of CVE-2024-45519, it’s crucial for Zimbra users to apply the necessary patches and employ proactive monitoring to avoid severe consequences, including full system compromise. Early detection and immediate response are essential to mitigating this threat.

A new vulnerability identified as CVE-2023-36884 in Microsoft Office has recently surfaced, adding to the growing list of 0-day flaws that could impact millions of users. The proof-of-concept (PoC) exploit for this critical vulnerability has been publicly disclosed, raising alarms in the cybersecurity community. With attackers potentially using this flaw to execute arbitrary code, the risk of system compromise, data theft, and network breaches is high.

In response, security experts are urging organizations to take swift actions to mitigate the risk. Here’s a detailed overview of CVE-2023-36884, the exploit, and the recommended steps for protection.

Understanding CVE-2023-36884: The Microsoft Office 0-Day Flaw

CVE-2023-36884 is a 0-day vulnerability that impacts Microsoft Office, one of the most widely used software suites in the world. As with all 0-day vulnerabilities, this flaw was unknown to the vendor at the time of its discovery, and there was no available patch when the vulnerability was initially exposed.

This particular flaw allows attackers to execute arbitrary code on a targeted system. The most common attack vector involves tricking a user into opening a maliciously crafted Office document, often delivered through email phishing campaigns. Once the document is opened, the attacker can exploit the vulnerability to run harmful code on the victim’s machine, potentially gaining full control of the system.

The PoC Exploit: Raising the Stakes

The recent public disclosure of a proof-of-concept (PoC) exploit for CVE-2023-36884 has dramatically raised the stakes. A PoC exploit demonstrates how the vulnerability can be used in a real-world attack, often serving as a roadmap for both attackers and defenders. Unfortunately, cybercriminals can weaponize these PoCs to create malicious campaigns aimed at exploiting unpatched systems.

With CVE-2023-36884, cybersecurity firms have reported increased attention in underground forums, where threat actors discuss and share exploit techniques. The widespread use of Microsoft Office products means that any exploit affecting them has the potential for significant global impact, especially within business environments.

Who Is Affected by CVE-2023-36884?

The scope of the vulnerability includes various versions of Microsoft Office, particularly those that haven’t been updated to the latest security standards. Organizations that delay patching or have lax security protocols are at an elevated risk.

Phishing campaigns are a primary delivery method for this exploit, where attackers send infected Office documents disguised as legitimate files. Once the victim opens the document, the malicious code executes, giving the attacker control over the system and potentially broader network access.

Mitigation Steps: How to Protect Against CVE-2023-36884

Although Microsoft is likely developing a patch to address CVE-2023-36884, organizations must take immediate actions to mitigate the risk in the meantime. Here are several key steps:

1. Apply the Latest Security Updates: Although the patch for this specific flaw may not yet be available, keeping all systems up to date with the latest security fixes reduces exposure to other vulnerabilities.

2. Disable Macros and Active Content: Many Office-based attacks rely on macros and active content. By disabling these features, you can prevent malicious scripts from running automatically when documents are opened.

3. Be Wary of Suspicious Attachments: Educate employees about the risks of opening attachments from unknown or untrusted sources, as phishing attacks are a common vector for this exploit.

4. Use Advanced Threat Protection: Deploy advanced endpoint detection and response (EDR) solutions to detect and block malicious activity. Email filtering systems can also help reduce the chance of a phishing attack reaching its target.

5. Implement Network Segmentation: By segmenting your network and enforcing access controls, you can limit the potential damage an attacker can cause if they exploit the vulnerability.

6. Monitor for Indicators of Compromise (IoCs): Keep a close eye on network traffic and system behavior for signs of compromise, such as abnormal document execution or unauthorized remote connections.

The Risks of Public Disclosure for CVE-2023-36884

The public release of a PoC exploit for CVE-2023-36884 highlights the dual-edged nature of vulnerability disclosure. While PoC code can be helpful for researchers and security vendors working on defense strategies, it can also be co-opted by cybercriminals to carry out attacks faster than organizations can react.

Given the widespread use of Microsoft Office across industries, the risk of a broad attack campaign is considerable. Without an immediate patch from Microsoft, organizations must rely on alternative defenses and mitigate the potential damage through best practices in cybersecurity.

Conclusion: Staying Ahead of 0-Day Vulnerabilities

CVE-2023-36884 serves as a stark reminder that the threat landscape is constantly evolving, and the emergence of a PoC exploit further underscores the importance of vigilance. Cybercriminals are quick to exploit vulnerabilities, especially in widely used software like Microsoft Office.

In the absence of an immediate patch, organizations must stay ahead by implementing proactive security measures and educating users on the dangers of phishing and suspicious attachments. By adopting a layered approach to security and maintaining updated defenses, companies can reduce the risk posed by CVE-2023-36884 and other emerging threats.

Introduction

CVE-2024-28987 is a critical vulnerability in SolarWinds Web Help Desk (WHD) that allows unauthenticated attackers to exploit hardcoded credentials. This flaw exposes organizations to significant risks, such as unauthorized access to help desk ticket data and potential lateral movement within the network. The vulnerability was reported by Horizon3.ai’s Zach Hanley, who uncovered it while analyzing another SolarWinds vulnerability (CVE-2024-28986), which is actively being exploited.

The Risk

The vulnerability affects all versions of SolarWinds Web Help Desk before Hotfix 2 (version 12.8.3). Attackers can use these hardcoded credentials to read, modify, or delete ticket details, potentially impacting service operations. Additionally, attackers who gain access to Web Help Desk can escalate privileges and move laterally across the network, endangering critical IT infrastructure.

One of the most concerning aspects is the potential exposure of sensitive credentials stored in help desk systems, which could lead to further security breaches.

Mitigation and Fix

To fix CVE-2024-28987, SolarWinds has released Web Help Desk 12.8.3 Hotfix 2. This hotfix not only addresses the hardcoded credentials flaw but also includes fixes from previous updates, such as CVE-2024-28986. The hotfix also solves bugs that affected the user interface and Single Sign-On (SSO) functionality.

Steps for mitigation include:

1. Apply the Hotfix: Immediately update to Web Help Desk 12.8.3 Hotfix 2 to eliminate the vulnerability. Ensure your instance is running the latest version of SolarWinds WHD.

2. Limit Network Access: Restrict access to Web Help Desk to internal users only, preventing external attackers from reaching the vulnerable system.

3. Update Credentials: Change any default or hardcoded credentials to unique and strong passwords.

4. Monitor Systems: Regularly check system logs for unauthorized access or unusual activity, which may indicate exploitation attempts.

5. Segment Networks: Implement network segmentation to isolate the WHD system from other critical infrastructure, reducing the risk of lateral movement.

Conclusion

CVE-2024-28987 presents a serious security risk for organizations relying on SolarWinds Web Help Desk. Immediate action is required to apply the available hotfix and reduce exposure. Beyond patching, additional security measures like credential updates and network monitoring should be employed to safeguard against this vulnerability.

By addressing CVE-2024-28987 quickly, organizations can prevent attackers from exploiting a flaw that could lead to significant operational disruptions and data breaches.

Security researchers have recently discovered a series of vulnerabilities within the widely used CUPS (Common UNIX Printing System), an open-source system utilized for managing printing tasks in Linux and Unix-like operating systems. These vulnerabilities, if exploited under specific conditions, could allow attackers to achieve remote code execution (RCE) on vulnerable systems. However, the good news is that these flaws do not affect systems in their default configuration.

Understanding the Vulnerabilities

The vulnerabilities, discovered by security researcher Simone Margaritelli, span multiple components of the CUPS system. Here’s a breakdown of the key vulnerabilities:

• CVE-2024-47076: A flaw in libcupsfilters.

• CVE-2024-47175: A vulnerability in libppd.

• CVE-2024-47176: An issue within cups-browsed.

• CVE-2024-47177: A problem related to cups-filters.

These vulnerabilities, when combined, could allow an attacker to remotely execute arbitrary code, potentially taking control of the system. The ability to chain these flaws together makes them particularly concerning, as they could be leveraged to escalate an attack.

What You Need to Know:

• Disable and/or remove the cups-browsed service: This component is one of the most vulnerable, so shutting it down can reduce exposure.

• Update your CUPS installation: As soon as security patches are available, apply them to ensure you’re not running a vulnerable version of CUPS.

• Block access to UDP port 631: This is the primary port used by CUPS for network printing. Consider also blocking DNS-SD (DNS Service Discovery) to prevent exploitation.

• The vulnerabilities affect “most” Linux distributions, “some” BSDs, and potentially Google ChromeOS, Oracle’s Solaris, and other systems, as CUPS is bundled to provide printing functionality in many operating systems.

• For exploitation over the internet or LAN, an attacker must be able to reach your CUPS service on UDP port 631. Ideally, this port should never be exposed to the public internet.

• The attacker also needs to wait for you to start a print job to trigger the vulnerability.

• Even if port 631 isn’t directly reachable, an attacker may spoof zeroconf, mDNS, or DNS-SD advertisements to gain access. The full details of this exploitation path will be disclosed at a later date.

The Catch: Default Configuration Mitigates Risk

While the vulnerabilities pose a significant risk, it’s important to emphasize that systems running CUPS in their default configuration are not affected. This is because the vulnerabilities rely on certain non-default configurations or services that are not typically enabled by default. As such, the attack surface is somewhat limited.

However, for organizations or individuals who have modified their CUPS configurations or are using more advanced features of the system, the risk becomes much higher. It’s critical to review your system’s configuration and assess whether any of these components are exposed in your environment.

Affected Systems

CUPS is the most commonly used printing system on Linux but is also supported on other Unix-like operating systems such as FreeBSD, NetBSD, OpenBSD, and their derivatives. Therefore, any systems running CUPS in a non-default configuration across these platforms could potentially be at risk.

Steps to Mitigate the Vulnerabilities

While these vulnerabilities do not impact default installations, here are some steps you can take to ensure your system remains secure:

1. Update Your Software: As always, the best protection against vulnerabilities is to ensure that your software is up to date. Keep an eye out for security patches from the CUPS project or your Linux/Unix distribution.

2. Review Configurations: Double-check your CUPS configuration and make sure it is as close to the default setup as possible unless additional functionality is absolutely necessary.

3. Disable Unnecessary Features: If you’re not using specific features such as cups-browsed or custom filters, consider disabling them. The fewer services running, the smaller your attack surface.

4. Limit Network Exposure: If you need to expose CUPS to a network, ensure that it is only accessible by trusted hosts. Properly configure firewalls to limit network access.

5. Monitor and Audit: Regularly monitor and audit the services running on your systems, particularly network-facing services like CUPS, for unusual activity or misconfigurations.

Importance of Patch Management

These CUPS vulnerabilities are a reminder of how crucial patch management and regular system audits are in maintaining a secure environment. Even if vulnerabilities do not affect default setups, misconfigurations or advanced customizations could introduce risk, underscoring the importance of regular review and testing.

Final Thoughts

The CUPS vulnerabilities—CVE-2024-47076, CVE-2024-47175, CVE-2024-47176, and CVE-2024-47177—demonstrate how interconnected flaws can be chained together to form a more serious attack vector. While default installations of CUPS are safe from exploitation, organizations and individuals with custom setups should take immediate steps to secure their environments.

By keeping systems up to date, minimizing unnecessary exposure, and carefully reviewing configurations, the risk of these vulnerabilities can be mitigated effectively.

SolarWinds, a leading IT management software provider, has recently disclosed two significant vulnerabilities, CVE-2024-28990 and CVE-2024-28991, in its Access Rights Manager (ARM) platform. These vulnerabilities pose serious risks, allowing attackers to bypass authentication and execute remote cod.

• CVE-2024-28990: Hardcoded credentials allow attackers to access the RabbitMQ management console.

• CVE-2024-28991: Remote code execution through deserialization of untrusted data.

A service update, ARM 2024.3.1, has been released, addressing these vulnerabilities alongside several bug fixes. SolarWinds emphasizes the importance of timely patching to mitigate enterprise risks.