critical

now browsing by tag

 
 

Exploits Released for As-Yet Unpatched Critical …

Source: National Cyber Security – Produced By Gregory Evans Organizations need to apply mitigations for vulnerability in Citrix Application Delivery Controller and Citrix Gateway ASAP, security researchers say. Organizations that have not yet applied recommended mitigations for a recently disclosed remotely exploitable flaw in the Citrix Application Delivery Controller (ADC) and Citrix Gateway products now […] View full post on AmIHackerProof.com

Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw

Source: National Cyber Security – Produced By Gregory Evans

drupal website hacking

If you haven’t recently updated your Drupal-based blog or business website to the latest available versions, it’s the time.

Drupal development team yesterday released important security updates for its widely used open-source content management software that addresses a critical and three “moderately critical” vulnerabilities in its core system.

Considering that Drupal-powered websites are among the all-time favorite targets for hackers, the website administrators are highly recommended to install the latest release Drupal 7.69, 8.7.11, or 8.8.1 to prevent remote hackers from compromising web servers.

Critical Symlinks Vulnerability in Drupal

The only advisory with critical severity includes patches for multiple vulnerabilities in a third-party library, called ‘Archive_Tar,’ that Drupal Core uses for creating, listing, extracting, and adding files to tar archives.

The vulnerability resides in the way the affected library untar archives with symlinks, which, if exploited, could allow an attacker to overwrite sensitive files on a targeted server by uploading a maliciously crafted tar file.

Due to this, to be noted, the flaw only affects Drupal websites that are configured to process .tar, .tar.gz, .bz2, or .tlz files uploaded by untrusted users.

According to Drupal developers, a proof-of-concept exploit for this vulnerability already exists and considering the popularity of Drupal exploits among hackers, you may see hackers actively exploiting this flaw in the wild to target Drupal websites.

Moderately Critical Drupal Vulnerabilities

Besides this critical vulnerability, Drupal developers have also patched three “moderately critical” vulnerabilities in its Core software, brief details of which are as follows:

  • Denial of Service (DoS): The install.php file used by Drupal 8 Core contains a flaw that can be exploited by a remote, unauthenticated attacker to impair the availability of a targeted website by corrupting its cached data.
  • Security Restriction Bypass: The file upload function in Drupal 8 does not strip leading and trailing dot (‘.’) from filenames, which can be used by an attacker with file upload ability to overwrite arbitrary system files, such as .htaccess to bypass security protections.
  • Unauthorized Access: This vulnerability exists in Drupal’s default Media Library module when it doesn’t correctly restrict access to media items in certain configurations. Thus, it could allow a low-privileged user to gain unauthorized access to sensitive information that is otherwise out of his reach.

According to the developers, affected website administrators can mitigate the access media bypass vulnerability by unchecking the “Enable advanced UI” checkbox on /admin/config/media/media-library, though this mitigation is not available in 8.7.x.

Web Application Firewall

All the above “moderately critical” vulnerabilities have been patched with the release of Drupal versions 8.7.11 and 8.8.1, and at the time of writing, no proof-of-concept for these flaws have been made available.

Since a proof-of-concept exists for the critical Drupal vulnerability, users running vulnerable versions of Drupal are highly recommended to update their CMS to the latest Drupal core release as soon as possible.

The Original Source Of This Story: Source link

The post Drupal Warns Web Admins to Update CMS Sites to Patch a Critical Flaw appeared first on National Cyber Security.

View full post on National Cyber Security

#cybersecurity | #hackerspace | Exploring The Critical Components Of DevOps

Source: National Cyber Security – Produced By Gregory Evans

In a world where development is conducted on a variety of operating systems and hosted on the cloud, having a well-structured development system with integrated security is vital to ensuring that customer solutions are functioning optimally and are secure. This is achieved through DevOps.

https://securityboulevard.com/

*** This is a Security Bloggers Network syndicated blog from Uptycs Blog authored by Rags Kinnigoly. Read the original post at: https://www.uptycs.com/blog/critical-components-devops

Source link

The post #cybersecurity | #hackerspace |<p> Exploring The Critical Components Of DevOps <p> appeared first on National Cyber Security.

View full post on National Cyber Security

#cybersecurity | #hackerspace | December 2019 Patch Tuesday – 36 Vulns, 7 Critical, Actively Attacked Win32k vuln, Adobe vulns

Source: National Cyber Security – Produced By Gregory Evans

This month’s Patch Tuesday is rather light and addresses 36 vulnerabilities, with only 7 labeled as Critical. Five of the seven Critical vulns are in Git for Visual Studio. The others are for Hyper-V and Win32k. Also, there is one actively attacked “Important” vuln in Win32k. Adobe released patches today covering Acrobat/Reader, ColdFusion, Photoshop, and Brackets.

Workstation Patches

Win32k patches (CVE-2019-1468 and CVE-2019-1458) should be prioritized for workstation-type devices, meaning any system that is used for email or to access the internet via a browser. This includes multi-user servers that are used as remote desktops for users.

Though listed as Important, Microsoft has disclosed that CVE-2019-1458 is actively attacked in the wild.

Hyper-V Hypervisor Escapes

A remote code execution vulnerability (CVE-2019-1471) is patched in Hyper-V that would allow an authenticated user on a guest system to run arbitrary code on the host system. Microsoft notes that exploitation of this vulnerability is less likely, but these patches should still be prioritized for all Hyper-V systems.

Git for Visual Studio

Microsoft patched 5 vulnerabilities (CVE-2019-1354, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387, and CVE-2019-1349) in Git for Visual Studio. Exploitation requires that a user clones a malicious repo. Based on the details provided, the vulnerabilities appear to all be Command Injection. These patches should be prioritized for any Visual Studio installations that use Git.

Adobe

Adobe’s Patch Tuesday covers Acrobat/Reader, ColdFusion, Photoshop, and Brackets. The patches for Acrobat/Reader (21 vulns) and ColdFusion (1 vuln) are listed as Priority 2, while the patches for Photoshop (2 vulns) and Brackets (1 vuln) are labeled Priority 3. The Acrobat/Reader patches should be prioritized for Workstations with this software installed, and the ColdFusion patches should be prioritized on ColdFusion servers.

Source link

The post #cybersecurity | #hackerspace |<p> December 2019 Patch Tuesday – 36 Vulns, 7 Critical, Actively Attacked Win32k vuln, Adobe vulns <p> appeared first on National Cyber Security.

View full post on National Cyber Security

Adobe Releases Patches for ‘Likely Exploitable’ Critical Vulnerabilities

Source: National Cyber Security – Produced By Gregory Evans

adobe software update

The last Patch Tuesday of 2019 is finally here.

Adobe today released updates for four of its widely used software—including Adobe Acrobat and Reader, Photoshop CC, ColdFusion, and Brackets—to patch a total of 25 new security vulnerabilities.

Seventeen of these flaws have been rated as critical in severity, with most of them carrying high priority patches, indicating that the vulnerabilities are more likely to be used in real-world attacks, but there are currently no known exploits in the wild.

The software update for Adobe Acrobat and Reader for Windows and macOS operating systems addresses a total of 21 security vulnerabilities, 14 of which are critical, and rest are important in severity.

Upon successful exploitation, all critical vulnerabilities in Adobe Acrobat and Reader software lead to arbitrary code execution attacks, allowing attackers to take complete control of targeted systems.

Adobe Photoshop CC for Windows and macOS contains patches for two critical arbitrary code execution vulnerabilities that were discovered and reported to the company by Honggang Ren of Fortinet’s FortiGuard Labs.

The last two flaws the company patched this month affect Brackets, a source code editor, and ColdFusion, a commercial rapid web application development platform by Adobe.

Web Application Firewall

The software update for Brackets addresses a critical code execution flaw, which was disclosed by Tavis Ormandy of Google Project Zero.

Adobe ColdFusion update comes with a security patch for an important privilege escalation bug, which occurs due to insecure inherited permissions of the default installation directory.

The company has released updated versions for all four vulnerable software for each impacted platform that users should install immediately to protect their systems and businesses from cyber-attacks.

If your system hasn’t yet detected the availability of the new update automatically, you should manually install the update by choosing “Help → Check for Updates” in your Adobe software.

The Original Source Of This Story: Source link

The post Adobe Releases Patches for ‘Likely Exploitable’ Critical Vulnerabilities appeared first on National Cyber Security.

View full post on National Cyber Security

Critical Flaw in GoAhead Web Server Could Affect Wide Range of IoT Devices

Source: National Cyber Security – Produced By Gregory Evans Cybersecurity researchers today uncovered details of two new vulnerabilities in the GoAhead web server software, a tiny application widely embedded in hundreds of millions of Internet-connected smart devices. One of the two vulnerabilities, assigned as CVE-2019-5096, is a critical code execution flaw that can be exploited […] View full post on AmIHackerProof.com

#cybersecurity | #hackerspace | Fortress Information Security Strives to Help Protect Critical Infrastructure

Source: National Cyber Security – Produced By Gregory Evans

The agencies and businesses that make up the backbone of our critical infrastructure have a larger bullseye on their backs than an average company. When it comes to the electric utility providers that manage the power grid, the exposure to risk is exacerbated by the fact that much of the equipment, software, and services come from a limited set of vendors. Fortress Information Security just launched the Asset to Vendor (A2V) Network to mitigate these risks and improve the security posture of the power grid.

The Federal Energy Regulatory Commission (FERC) recognizes the unique threats posed to the power grid and understands that it’s crucial to address these challenges and protect the critical infrastructure. FERC has issued requirements for standardized risk assessments and mandated that electric utility providers prioritize supply chain vendors based on their relative risk. The problem is that many of the 3,000 or so electric providers are small, regional companies that don’t have the budget or resources to do this effectively on their own.

The A2V Network was launched as a joint venture between Fortress and AEP (American Electric Power) to address this challenge and help all electric utility companies collaborate to comply with the FERC regulations and improve protection of the critical infrastructure more efficiently and effectively. Organizations that join the A2V Network will be able to purchase completed vendor assessments for significantly less than it would cost them to conduct a redundant assessment of their own, and participating companies can also contribute completed assessments to build out the A2V Network library.

Reluctance to Share

I had an opportunity to chat with Alex Santos, CEO of Fortress, about the A2V Network and some of the challenges it addresses. He described the supply chain like streets in a community. Just as each person is responsible of their own home and property, but share the roads and pay taxes to share the burden and ensure the roads are taken care of, each company is responsible for itself, but they share risk exposure from the supply chain and it makes sense to collaborate and share the burden to mitigate the risk and secure the critical infrastructure.

I asked Santos for his thoughts on why businesses in general—not just electric power providers—seem so reluctant to engage in this sort of sharing and collaborative effort. The two main issues, according to Santos are that some information is very proprietary, and some information is not very good. Companies want to maintain the privacy of intellectual property and sensitive information. In some cases, there is a competitive advantage associated and sharing it is just bad for business. In other instances, organizations are reluctant to engage in sharing information because what they receive is not useful. If the information is not properly vetted and curated to ensure it is correct and relevant, it creates more problems than it solves.

Santos explained that the A2V Network strives to address both of those challenges. The A2V Network takes information about supply chain risk assessments and provides a platform to easily share it while anonymizing it and protecting the privacy of proprietary data. Part of what the A2V Network also does is to validate the information and make it actionable.

Gaining Momentum

Santos was especially grateful for having AEP as a partner for the launch of the A2V Network. He noted that even though there are 3,000 electric utility providers, only about 150 of those are large enough to be regulated by the North American Electric Reliability Corporation (NERC)—and that the top 15 largest deliver power for 75% of consumers. That leaves nearly 2,900 companies that must comply with the FERC regulation but lack the resources to do it effectively on their own.

He said that having AEP on board is huge because any new movement or initiative requires a first big company to get the ball rolling. AEP showed leadership in taking that initiative and having a company with the size and prestige of AEP involved creates a snowball effect that will entice other electric utility providers to jump on board.

The more companies get involved, the more momentum the A2V Network will have and the greater value it will provide to every participating organization. That, in turn, will attract more companies. It becomes a self-feeding cycle of momentum that will ultimately lead to a more secure critical infrastructure.

Source link

The post #cybersecurity | #hackerspace |<p> Fortress Information Security Strives to Help Protect Critical Infrastructure <p> appeared first on National Cyber Security.

View full post on National Cyber Security

Watch Out IT Admins! Two Unpatched Critical RCE Flaws Disclosed in rConfig

Source: National Cyber Security – Produced By Gregory Evans

rConfig network configuration management vulnerability

If you’re using the popular rConfig network configuration management utility to protect and manage your network devices, here we have an important and urgent warning for you.

A cybersecurity researcher has recently published details and proof-of-concept exploits for two unpatched, critical remote code execution vulnerabilities in the rConfig utility, at least one of which could allow unauthenticated remote attackers to compromise targeted servers.

Written in native PHP, rConfig is a free, open source network device configuration management utility that allows network engineers to configure and take frequent configuration snapshots of their network devices.

According to the project website, rConfig is being used to manage more than 3.3 million network devices, including switches, routers, firewalls, load-balancer, WAN optimizers.

What’s more worrisome? Both vulnerabilities affect all versions of rConfig, including the latest rConfig version 3.9.2, with no security patch available at the time of writing.

Discovered by Mohammad Askar, each flaw resides in a separate file of rConfig—one, tracked as CVE-2019-16662, can be exploited remotely without requiring pre-authentication, while the other, tracked as CVE-2019-16663, requires authentication before its exploitation.

  • Unauthenticated RCE (CVE-2019-16662) in ajaxServerSettingsChk.php
  • Authenticated RCE (CVE-2019-16663) in search.crud.php

In both cases, to exploit the flaw, all an attacker needs to do is access the vulnerable files with a malformed GET parameter designed to execute malicious OS commands on the targeted server.

rConfig vulnerability

As shown in the screenshots shared by the researcher, the PoC exploits allow attackers to get a remote shell from the victim’s server, enabling them to run any arbitrary command on the compromised server with the same privileges as of the web application.

Meanwhile, another independent security researcher analysed the flaws and discovered that the second RCE vulnerability could also be exploited without requiring authentication in rConfig versions prior to version 3.6.0.

“After reviewing rConfig’s source code, however, I found out that not only rConfig 3.9.2 has those vulnerabilities but also all versions of it. Furthermore, CVE-2019-16663, the post-auth RCE can be exploited without authentication for all versions before rConfig 3.6.0,” said the researcher, who goes by online alias Sudoka.

Askar responsibly reported both vulnerabilities to the rConfig project maintainers almost a month back and then recently decided to release details and PoC publicly after the maintainers failed to acknowledge or respond to his findings.

If you are using rConfig, you are recommended to temporarily remove it from your server until security patches arrive.

The Original Source Of This Story: Source link

The post Watch Out IT Admins! Two Unpatched Critical RCE Flaws Disclosed in rConfig appeared first on National Cyber Security.

View full post on National Cyber Security

Cybersecurity a #critical area for #closer #cooperation between #Asean and #Australia

Asean and Australia should work closer together on cybersecurity issues, which range from Internet crimes to fake news, Prime Minister Lee Hsien Loong said on Sunday (March 18).

In a speech to other Asean leaders and Australian Prime Minister Malcolm Turnbull during a plenary session at the Asean-Australia Special Summit, he noted that cybercrimes are a transboundary problem that is difficult to police.

“It can have a drastic impact on our populations, for example in terms of critical infrastructure; and it can be insidious – undermining the trust which holds our societies together, for example through fake news.”

The world is getting more vulnerable to cybersecurity threats, not less, he added, and so it is essential for governments to develop new rules and norms to cope with the challenge.

There is also potential for this region to play a role in the international discourse on cyber-security, Mr Lee said, noting that a proposed Asean-Australia Cyber Policy Dialogue can be a platform for greater policy exchange and capacity-building.

Another promising area for strategic cooperation is in developing smart cities, he said.

A new Asean-Australia Smart Cities Initiative, announced by Mr Turnbull on Saturday, complements the Asean Smart Cities Network initiative and Asean’s Masterplan on Asean Connectivity 2025, he added.

Read More….

advertisement:

The post Cybersecurity a #critical area for #closer #cooperation between #Asean and #Australia appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

Cyber Security for Critical Assets (CS4CA) USA

Source: National Cyber Security – Produced By Gregory Evans

General Cybersecurity Conference

 March 6 – 8, 2018 | Houston, Texas, United States

Cybersecurity Conference Description 

The Annual Cyber Security for Critical Assets Summit (USA) boasts two dedicated streams for IT and OT, allowing delegates to hone in on their specialist areas of interest, as well as plenary sessions addressing the common issues that bind both groups of professionals. Each stream is curated by a group of industry-leading experts to be as relevant, as cutting-edge and as in-depth as possible over two days.

Expect to be challenged, learn new techniques from some of the world’s top cyber security innovators and network with your peers at Europe’s leading critical infrastructure security event. You’ll hear exclusive keynotes from leading industry execs, you’ll get the chance to take part in interactive panel debates to benchmark your approach with others, you’ll get in-depth case studies relevant to your sector with tangible, actionable insights and you’ll get platform presentations showcasing the best of tomorrow’s technology.

The post Cyber Security for Critical Assets (CS4CA) USA appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures