Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.
Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.
Google Chrome Zero-day under active exploitation
The latest stable channel update for the desktop installation of the Chrome web browser has seen Google fix several high-risk vulnerabilities and one medium-risk vulnerability, numbering five in total.
The highlight of the five patches includes the heap buffer overflow in FreetType flaw, tagged CVE-2020-15999 and rated ‘high’, which is a zero-day flaw which attackers are actively exploiting. FreeType is a widely used software development library that’s also a Chrome component, and the bug in this font rendering library affects the browser on Windows, macOS as well as Linux.
Privilege escalation flaws in Citrix VPN
The Citrix Gateway Plug-In for Windows, a widely used business-oriented virtual private network (VPN), is embedded with multiple escalation of privilege flaws, according to cyber security researchers from Cymptom.
Tagged as CVE-2020-8257 and CVE-2020-8258, these two vulnerabilities lie in the way the Citrix Gateway Service runs as SYSTEM, and executes a periodic PowerShell script every five minutes, also executed as SYSTEM. As powershell.exe is invoked in file name only, Windows searches through multiple directories to find it. Hackers could exploit this by creating a malicious file, naming it powershell.exe, and copying it into every directory they have access to, which would allow them to achieve elevation of privileges on systems running Citrix Gateway Plug-In for Windows.
VMware software breaking Cisco HyperFlex clusters
This week Cisco warned HyperFlex users that a VMware coding bug in vCenter Server 7.0 U1may leave their hyperconverged infrastructure installations in an ‘unrecoverable’ state.
The bug, which affects HyperFlex controllers managed by the vCenter ESX Agent Manager (EAM) service, causes affected HyperFlex clusters to encounter an issue where HyperFlex controller VMs suddenly power off and are deleted. This results in the loss of cluster availability, and sometimes can even render the HyperFlex storage cluster “unrecoverable”.
There are no workarounds available at this time, with cisco recommending that customers do not use vCenter 7.0 GA or vCenter 7.0 U1 until they are qualified and listed as a supported combination in the HyperFlex Data Platform release notes.
KashmirBlack botnet hitting CMS platforms
The existence of one of the most sophisticated active botnets was disclosed this week, with researchers detailing how KashmirBlack, as it’s called, has compromised hundreds of thousands of systems to attack content management systems (CMS).
Spread across 30 countries, and conducting millions of attacks each day, this botnet exploits a decade-old PHPUnite remote code execution flaw to attack CMS platforms, mainly due to their generally poor cyber hygiene.
This particular flaw is known and patchable, but the botnet has capitalised on the surge in the companies disrupted by coronavirus, which now require easy-to-use web frameworks to move their business online. This includes well-known platforms like WordPress.
Address spoofing bug hits widely-used mobile browsers
Several popular mobile web browsers, including Safari and Opera Touch, are susceptible to exploitation due to a web address spoofing bug that could allow hackers to perform spear-phishing attacks, or deploy malware.
The vulnerability could allow an attacker to set up a malicious website and tempt a victim into opening a link from a spoofed email or text message. This would then lead the user to a malicious site disguised as a legitimate site, on which they could download a malicious file, or hand over personal information.
The origin lies in the way a hacker could execute malicious JavaScript code on this website to force the browser to update the address bar to another address of the attacker’s preference, all while the page loads.
Emergency WordPress patch for SQL injection attack
The Loginizer security plugin for WordPress, which has more than a million active installations, was forcibly patched by the CMS platform this week after WP Deeply researchers disclosed a dangerous vulnerability.
The plugin, which protects sites from brute force attacks, was afflicted with an SQL injection bug that could have allowed hackers to seize control of users’ WordPress sites. This severe vulnerability lies in the plug-in’s core brute force protection mechanism, and can be exploited by a hacker who logs into a WordPress site using a malformed username, in which they include SQL statements.
Upon failed authentication, Loginizer will record this failed attempt in the site’s database, along with the failed username, however, the plugin doesn’t wipe the username and leaves the SQL statements intact. This opens the door for attackers to run code against the database remotely, and compromise the site.
Ryuk ransomware strikes again - targeting French IT giant
Hackers linked with the Ryuk ransomware group have attacked the IT services firm Sopra Steria, although the French company has revealed few little details around the nature or scale of the cyber attack.
The company runs a joint venture with the UK’s Department of Health and Social Care to offer services such as accounting, payroll and managed IT to NHS organisations. It’s unclear whether any of these services have been disrupted as a result of the attack, although French media have claimed the Ryuk malware strain is to blame. Other organisations are being warned to stay alert with regards to the ongoing disruptive threat that ransomware poses.
