Vulnerabilidad de tipo XXE en múltiples productos de Dell EMC
Fecha de publicación: 11/10/2019
Importancia: 4 - Alta
Recursos afectados:
Dell EMC Avamar Server, versiones 7.4.1, 7.5.0, 7.5.1, 18.2 y 19.1;
Dell EMC Integrated Data Protection Appliance (IDPA), versiones 2.0, 2.1, 2.2, 2.3 y 2.4.
Descripción:
Múltiples productos de Dell EMC contienen una vulnerabilidad, clasificada con severidad alta, de inyección de Entidad Externa XML (XXE).
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-tipo-xxe-multiples-productos-dell-emc
Fecha de publicación: 11/10/2019
Importancia: 4 - Alta
Recursos afectados:
Dell EMC Avamar Server, versiones 7.4.1, 7.5.0, 7.5.1, 18.2 y 19.1;
Dell EMC Integrated Data Protection Appliance (IDPA), versiones 2.0, 2.1, 2.2, 2.3 y 2.4.
Descripción:
Múltiples productos de Dell EMC contienen una vulnerabilidad, clasificada con severidad alta, de inyección de Entidad Externa XML (XXE).
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-tipo-xxe-multiples-productos-dell-emc
INCIBE-CERT
Vulnerabilidad de tipo XXE en múltiples productos de Dell EMC
Múltiples productos de Dell EMC contienen una vulnerabilidad, clasificada con severidad alta, de inyección de Entidad Externa XML (XXE).
New #IDAPro plugin provides #TileGX support
Overview
Cisco Talos has a new plugin available for IDA Pro that provides a new disassembler for TileGX binaries. This tool should assist researchers in reverse-engineering threats in IDA Pro that target TileGX.
https://blog.talosintelligence.com/2019/10/new-ida-pro-plugin-provides-tilegx.html
Overview
Cisco Talos has a new plugin available for IDA Pro that provides a new disassembler for TileGX binaries. This tool should assist researchers in reverse-engineering threats in IDA Pro that target TileGX.
https://blog.talosintelligence.com/2019/10/new-ida-pro-plugin-provides-tilegx.html
Cisco Talos Blog
New IDA Pro plugin provides TileGX support
Talos intelligence and world-class threat research team better protects you and your organization against known and emerging cybersecurity threats.
Bypass #McAfee with McAfee
Introduction
I wasn’t actually planning on writing this blog. Not because it’s super secretive or anything, but because I’m super lazy. Unfortunately, @fsdominguez and @_dirkjan forced me.
So here we are.. ¯\(ツ)/¯.
This is a story about how I used McAfee tools to bypass McAfee Endpoint Security during a (very TIBER-y) Red Team assignment we (aforementioned people and myself) were running. Let’s go.
https://dmaasland.github.io/posts/mcafee.html
Introduction
I wasn’t actually planning on writing this blog. Not because it’s super secretive or anything, but because I’m super lazy. Unfortunately, @fsdominguez and @_dirkjan forced me.
So here we are.. ¯\(ツ)/¯.
This is a story about how I used McAfee tools to bypass McAfee Endpoint Security during a (very TIBER-y) Red Team assignment we (aforementioned people and myself) were running. Let’s go.
https://dmaasland.github.io/posts/mcafee.html
#Debian Security Advisory
DSA-4543-1 #sudo -- security update
Date Reported:14 Oct 2019
Affected Packages:sudo
Vulnerable:Yes
Security database references:In the Debian bugtracking system: Bug 942322.
In Mitre's CVE dictionary: CVE-2019-14287.
https://www.debian.org/security/2019/dsa-4543
DSA-4543-1 #sudo -- security update
Date Reported:14 Oct 2019
Affected Packages:sudo
Vulnerable:Yes
Security database references:In the Debian bugtracking system: Bug 942322.
In Mitre's CVE dictionary: CVE-2019-14287.
https://www.debian.org/security/2019/dsa-4543
Potential bypass of Runas user restrictions
Release Date:October 14, 2019
Summary:
When #sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.
This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.
Log entries for commands run this way will list the target user as 4294967295 instead of root. In addition, PAM session modules will not be run for the command.
Sudo versions affected:
Sudo versions prior to 1.8.28 are affected.
https://www.sudo.ws/alerts/minus_1_uid.html
Release Date:October 14, 2019
Summary:
When #sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.
This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification.
Log entries for commands run this way will list the target user as 4294967295 instead of root. In addition, PAM session modules will not be run for the command.
Sudo versions affected:
Sudo versions prior to 1.8.28 are affected.
https://www.sudo.ws/alerts/minus_1_uid.html
Sudo
Potential bypass of Runas user restrictions
When sudo is configured to allow a user to run commands as an arbitrary user via the ALL keyword in a Runas specification, it is possible to run commands as root by specifying the user ID -1 or 4294967295.
This can be used by a user with sufficient sudo privileges…
This can be used by a user with sufficient sudo privileges…
Actualización de seguridad 5.2.4 para WordPress
Fecha de publicación: 15/10/2019
Importancia: 3 - Media
Recursos afectados:
WordPress, versiones 5.2.3 y anteriores.
Descripción:
Se ha publicado la última versión de WordPress, que corrige 6 problemas de seguridad.
Solución:
Actualizar a la versión 5.2.4.
Las versiones actualizadas de WordPress 5.1 y anteriores también están disponibles para cualquier usuario que aún no haya actualizado a la versión 5.2.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-524-wordpress
Fecha de publicación: 15/10/2019
Importancia: 3 - Media
Recursos afectados:
WordPress, versiones 5.2.3 y anteriores.
Descripción:
Se ha publicado la última versión de WordPress, que corrige 6 problemas de seguridad.
Solución:
Actualizar a la versión 5.2.4.
Las versiones actualizadas de WordPress 5.1 y anteriores también están disponibles para cualquier usuario que aún no haya actualizado a la versión 5.2.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizacion-seguridad-524-wordpress
INCIBE-CERT
Actualización de seguridad 5.2.4 para WordPress
Se ha publicado la última versión de WordPress, que corrige 6 problemas de seguridad.
Evasión de restricciones de Runas en sudo
Fecha de publicación: 15/10/2019
Importancia: 4 - Alta
Recursos afectados:
Sudo, versiones anteriores a la 1.8.28.
Descripción:
Una vulnerabildiad de criticidad alta en sudo podría permitir a un atacante evadir las restricciones Runas y ejecutar comandos como root.
Solución:
Actualizar a la versión 1.8.28.
Detalle:
Cuando sudo es configurado para permitir a los usuarios ejecutar comandos arbitrarios mediante el parámetro ALL en Runas, es posible ejecutar comandos como root empleando los ID de usuario -1 o 4294967295. Un atacante local, autenticado, con privilegios de sudo, podría ejecutar comandos como root evadiendo las restricciones de usuario de Runas en el sistema. Se ha reservado el identificador CVE-2019-14287 para esta vulnerabilidad.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/evasion-restricciones-runas-sudo
Fecha de publicación: 15/10/2019
Importancia: 4 - Alta
Recursos afectados:
Sudo, versiones anteriores a la 1.8.28.
Descripción:
Una vulnerabildiad de criticidad alta en sudo podría permitir a un atacante evadir las restricciones Runas y ejecutar comandos como root.
Solución:
Actualizar a la versión 1.8.28.
Detalle:
Cuando sudo es configurado para permitir a los usuarios ejecutar comandos arbitrarios mediante el parámetro ALL en Runas, es posible ejecutar comandos como root empleando los ID de usuario -1 o 4294967295. Un atacante local, autenticado, con privilegios de sudo, podría ejecutar comandos como root evadiendo las restricciones de usuario de Runas en el sistema. Se ha reservado el identificador CVE-2019-14287 para esta vulnerabilidad.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/evasion-restricciones-runas-sudo
INCIBE-CERT
Evasión de restricciones de Runas en sudo
Una vulnerabilidad de criticidad alta en sudo podría permitir a un atacante evadir las restricciones Runas y ejecutar comandos como root.
VMware Releases Security Update for Harbor Container Registry for PCF
VMware has released a security update to address a vulnerability affecting Harbor Container Registry for Pivotal Cloud Foundry (PCF). An attacker could exploit this vulnerability to take control of an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory VMSA-2019-0016 and apply the necessary update.
https://www.us-cert.gov/ncas/current-activity/2019/10/16/vmware-releases-security-update-harbor-container-registry-pcf
VMware has released a security update to address a vulnerability affecting Harbor Container Registry for Pivotal Cloud Foundry (PCF). An attacker could exploit this vulnerability to take control of an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review VMware Security Advisory VMSA-2019-0016 and apply the necessary update.
https://www.us-cert.gov/ncas/current-activity/2019/10/16/vmware-releases-security-update-harbor-container-registry-pcf
www.us-cert.gov
VMware Releases Security Update for Harbor Container Registry for PCF | CISA
VMware has released a security update to address a vulnerability affecting Harbor Container Registry for Pivotal Cloud Foundry (PCF). An attacker could exploit this vulnerability to take control of an affected system.
The Cybersecurity and Infrastructure…
The Cybersecurity and Infrastructure…
“Puss in Boots” APT campaign
Have you ever thought about what your answer would be if your precocious child asked, “What’s a politically motivated APT attack?” In fact, it’s straightforward. Just dust off your copy of Charles Perrault’s Puss in Boots and read it together with an eye on the cybersecurity aspects. After all, if we ignore the artistic liberties, such as a talking cat and ogres, the tale represents a marvelous example of a complex multivector APT attack against a (fictional) government. Let’s unpick this cybercrime together.
https://www.kaspersky.com/blog/operation-puss-in-boots/28963/
Have you ever thought about what your answer would be if your precocious child asked, “What’s a politically motivated APT attack?” In fact, it’s straightforward. Just dust off your copy of Charles Perrault’s Puss in Boots and read it together with an eye on the cybersecurity aspects. After all, if we ignore the artistic liberties, such as a talking cat and ogres, the tale represents a marvelous example of a complex multivector APT attack against a (fictional) government. Let’s unpick this cybercrime together.
https://www.kaspersky.com/blog/operation-puss-in-boots/28963/
Kaspersky
"Puss in Boots" APT campaign
Charles Perrault explains how hired hackers use social engineering and watering hole attacks for political purposes.
Actualizaciones críticas en Oracle (octubre 2019)
Fecha de publicación: 16/10/2019
Importancia: 5 - Crítica
Descripción:
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades que afectan a múltiples productos.
Solución:
Aplicar los parches correspondientes según los productos afectados. La información para descargar las actualizaciones puede obtenerse del boletín de seguridad publicado por Oracle.
Detalle:
Esta actualización resuelve un total de 219 vulnerabilidades, algunas de las cuales son críticas. El detalle de las vulnerabilidades resueltas se puede consultar en el enlace de Oracle de la sección de Referencias.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-octubre-2019
Fecha de publicación: 16/10/2019
Importancia: 5 - Crítica
Descripción:
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades que afectan a múltiples productos.
Solución:
Aplicar los parches correspondientes según los productos afectados. La información para descargar las actualizaciones puede obtenerse del boletín de seguridad publicado por Oracle.
Detalle:
Esta actualización resuelve un total de 219 vulnerabilidades, algunas de las cuales son críticas. El detalle de las vulnerabilidades resueltas se puede consultar en el enlace de Oracle de la sección de Referencias.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-octubre-2019
INCIBE-CERT
Actualizaciones críticas en Oracle (octubre 2019)
Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades que afectan a múltiples productos.
Vulnerabilidad en Workload Scheduler de IBM
Fecha de publicación: 16/10/2019
Importancia: 4 - Alta
Recursos afectados:
Tivoli Workload Scheduler Distributed, versión 9.2.0 FP03 y anteriores.
IBM Workload Scheduler Distributed:
versión 9.3.0 FP03 y anteriores,
versión 9.4.0 FP05 y anteriores,
versión 9.5.0 GA.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-workload-scheduler-ibm
Fecha de publicación: 16/10/2019
Importancia: 4 - Alta
Recursos afectados:
Tivoli Workload Scheduler Distributed, versión 9.2.0 FP03 y anteriores.
IBM Workload Scheduler Distributed:
versión 9.3.0 FP03 y anteriores,
versión 9.4.0 FP05 y anteriores,
versión 9.5.0 GA.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-workload-scheduler-ibm
INCIBE-CERT
Vulnerabilidad en Workload Scheduler de IBM
Davide Cioccia, ingeniero senior de seguridad en ING, ha detectado la vulnerabilidad de criticidad alta. Un atacante local podría modificar ficheros u obtener privilegios de root en el sistema.
Adobe Releases Security Updates for Multiple Products
Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Adobe Security Bulletins and apply the necessary updates:
Experience Manager APSB19-48
Acrobat and Reader APSB19-49
Experience Manager Forms APSB19-50
Download Manager APSB19-51
https://www.us-cert.gov/ncas/current-activity/2019/10/15/adobe-releases-security-updates-multiple-products
Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Adobe Security Bulletins and apply the necessary updates:
Experience Manager APSB19-48
Acrobat and Reader APSB19-49
Experience Manager Forms APSB19-50
Download Manager APSB19-51
https://www.us-cert.gov/ncas/current-activity/2019/10/15/adobe-releases-security-updates-multiple-products
www.us-cert.gov
Adobe Releases Security Updates for Multiple Products | CISA
Adobe has released security updates to address vulnerabilities in multiple Adobe products. An attacker could exploit some of these vulnerabilities to take control of an affected system.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages…
The Cybersecurity and Infrastructure Security Agency (CISA) encourages…
Múltiples vulnerabilidades en productos Cisco
Fecha de publicación: 17/10/2019
Importancia: 5 - Crítica
Recursos afectados:
Prodcutos de Cisco que estén ejecutando una versión vulnerable de:
Aironet 1540 Series APs,
Aironet 1560 Series APs,
Aironet 1800 Series APs,
Aironet 1810 Series APs,
Aironet 1830 Series APs,
Aironet 1850 Series APs,
Aironet 2800 Series APs,
Aironet 3800 Series APs,
Aironet 4800 APs,
Catalyst 9100 APs (la versión 8.9.100.0 es la primera versión soportada).
Cisco WLC Software, versión 8.5.140.0 y anteriores;
Cisco SPA112 2-Port Phone Adapter y SPA122 ATA con Router, versión de firmware 1.4.1 SR4 y anteriores, con la interfaz de gestión basada en web habilitada;
Cisco 250 Series Smart Switches;
Cisco 350 Series Managed Switches;
Cisco 550X Series Stackable Managed Switches.
Descripción:
Cisco ha publicado 18 vulnerabilidades, 1 de severidad crítica y 17 de severidad alta, que afectan a sus productos.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-cisco-57
Fecha de publicación: 17/10/2019
Importancia: 5 - Crítica
Recursos afectados:
Prodcutos de Cisco que estén ejecutando una versión vulnerable de:
Aironet 1540 Series APs,
Aironet 1560 Series APs,
Aironet 1800 Series APs,
Aironet 1810 Series APs,
Aironet 1830 Series APs,
Aironet 1850 Series APs,
Aironet 2800 Series APs,
Aironet 3800 Series APs,
Aironet 4800 APs,
Catalyst 9100 APs (la versión 8.9.100.0 es la primera versión soportada).
Cisco WLC Software, versión 8.5.140.0 y anteriores;
Cisco SPA112 2-Port Phone Adapter y SPA122 ATA con Router, versión de firmware 1.4.1 SR4 y anteriores, con la interfaz de gestión basada en web habilitada;
Cisco 250 Series Smart Switches;
Cisco 350 Series Managed Switches;
Cisco 550X Series Stackable Managed Switches.
Descripción:
Cisco ha publicado 18 vulnerabilidades, 1 de severidad crítica y 17 de severidad alta, que afectan a sus productos.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-productos-cisco-57
INCIBE-CERT
Múltiples vulnerabilidades en productos Cisco
Cisco ha publicado 18 vulnerabilidades, 1 de severidad crítica y 17 de severidad alta, que afectan a sus productos.
ISC Releases Security Advisories for #BIND
The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of ISC Berkeley Internet Name Domain (BIND). A remote attacker could exploit one of these vulnerabilities to obtain sensitive information.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the ISC advisories for CVE-2019-6475 and CVE-2019-6476 for more information and to apply the necessary updates and workarounds.
https://www.us-cert.gov/ncas/current-activity/2019/10/17/isc-releases-security-advisories-bind
The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of ISC Berkeley Internet Name Domain (BIND). A remote attacker could exploit one of these vulnerabilities to obtain sensitive information.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the ISC advisories for CVE-2019-6475 and CVE-2019-6476 for more information and to apply the necessary updates and workarounds.
https://www.us-cert.gov/ncas/current-activity/2019/10/17/isc-releases-security-advisories-bind
www.us-cert.gov
ISC Releases Security Advisories for BIND | CISA
The Internet Systems Consortium (ISC) has released security advisories that address vulnerabilities affecting multiple versions of ISC Berkeley Internet Name Domain (BIND). A remote attacker could exploit one of these vulnerabilities to obtain sensitive information.
[SECURITY] [DLA 1960-1] #wordpress security update
Package : wordpress
Version : 4.1.27+dfsg-0+deb8u1
CVE ID : CVE-2019-16217 CVE-2019-16218 CVE-2019-16219 CVE-2019-16220 CVE-2019-16221 CVE-2019-16222 CVE-2019-16223
Debian Bug : 939543
Several cross-site scripting (XSS) vulnerabilities were discovered in Wordpress, a popular content management framework. An attacker can use these flaws to send malicious scripts to an unsuspecting user.
For Debian 8 "Jessie", these problems have been fixed in version 4.1.27+dfsg-0+deb8u1.
We recommend that you upgrade your wordpress packages.
https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html
Package : wordpress
Version : 4.1.27+dfsg-0+deb8u1
CVE ID : CVE-2019-16217 CVE-2019-16218 CVE-2019-16219 CVE-2019-16220 CVE-2019-16221 CVE-2019-16222 CVE-2019-16223
Debian Bug : 939543
Several cross-site scripting (XSS) vulnerabilities were discovered in Wordpress, a popular content management framework. An attacker can use these flaws to send malicious scripts to an unsuspecting user.
For Debian 8 "Jessie", these problems have been fixed in version 4.1.27+dfsg-0+deb8u1.
We recommend that you upgrade your wordpress packages.
https://lists.debian.org/debian-lts-announce/2019/10/msg00023.html
Four-Year-Old Critical #Linux Wi-Fi Bug Allows System Compromise
A patch is currently under revision but has not yet been incorporated into the Linux kernel.
A critical Linux bug has been discovered that could allow attackers to fully compromise vulnerable machines. A fix has been proposed but has not yet been incorporated into the Linux kernel.
The flaw (CVE-2019-17666), which was classified as critical in severity, exists in the “rtlwifi” driver, which is a software component used to allow certain #Realtek Wi-Fi modules, used in Linux devices, to communicate with the Linux operating system.
https://threatpost.com/critical-linux-wi-fi-bug-system-compromise/149325/
A patch is currently under revision but has not yet been incorporated into the Linux kernel.
A critical Linux bug has been discovered that could allow attackers to fully compromise vulnerable machines. A fix has been proposed but has not yet been incorporated into the Linux kernel.
The flaw (CVE-2019-17666), which was classified as critical in severity, exists in the “rtlwifi” driver, which is a software component used to allow certain #Realtek Wi-Fi modules, used in Linux devices, to communicate with the Linux operating system.
https://threatpost.com/critical-linux-wi-fi-bug-system-compromise/149325/
Threat Post
Four-Year-Old Critical Linux Wi-Fi Bug Allows System Compromise
A patch is currently under revision but has not yet been incorporated into the Linux kernel.
DLA-1965-1 nfs-utils -- LTS security update
Date Reported:19 Oct 2019
Affected Packages:nfs-utils
Vulnerable:Yes
Security database references:
In the Debian bugtracking system: Bug 940848.
In Mitre's CVE dictionary: CVE-2019-3689.
More information:
In the nfs-utils package, providing support files for Network File System (NFS) including the rpc.statd daemon, the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
For Debian 8 Jessie, this problem has been fixed in version 1.2.8-9+deb8u1.
We recommend that you upgrade your nfs-utils packages.
https://www.debian.org/lts/security/2019/dla-1965
Date Reported:19 Oct 2019
Affected Packages:nfs-utils
Vulnerable:Yes
Security database references:
In the Debian bugtracking system: Bug 940848.
In Mitre's CVE dictionary: CVE-2019-3689.
More information:
In the nfs-utils package, providing support files for Network File System (NFS) including the rpc.statd daemon, the directory /var/lib/nfs is owned by statd:nogroup. This directory contains files owned and managed by root. If statd is compromised, it can therefore trick processes running with root privileges into creating/overwriting files anywhere on the system.
For Debian 8 Jessie, this problem has been fixed in version 1.2.8-9+deb8u1.
We recommend that you upgrade your nfs-utils packages.
https://www.debian.org/lts/security/2019/dla-1965
Evasión de autentificación en Citrix Application Delivery Controller y Citrix Gateway
Fecha de publicación: 21/10/2019
Importancia: 4 - Alta
Recursos afectados:
Citrix ADC y Citrix Gateway versión 13.0, hasta la build 41.20;
Citrix ADC y NetScaler Gateway versión 12.1, hasta la build 54.13;
Citrix ADC y NetScaler Gateway versión 12.0, hasta la build 62.8;
Citrix ADC y NetScaler Gateway version 11.1, hasta la build 62.8;
Citrix ADC y NetScaler Gateway version 10.5, hasta la build 70.5.
Descripción:
Se ha identificado una vulnerabilidad en la interfaz de gestión de Citrix Application Delivery Controller (ADC), anteriormente conocida como NetScaler ADC, y Citrix Gateway, anteriormente conocida como NetScaler Gateway.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/evasion-autentificacion-citrix-application-delivery-controller-y
Fecha de publicación: 21/10/2019
Importancia: 4 - Alta
Recursos afectados:
Citrix ADC y Citrix Gateway versión 13.0, hasta la build 41.20;
Citrix ADC y NetScaler Gateway versión 12.1, hasta la build 54.13;
Citrix ADC y NetScaler Gateway versión 12.0, hasta la build 62.8;
Citrix ADC y NetScaler Gateway version 11.1, hasta la build 62.8;
Citrix ADC y NetScaler Gateway version 10.5, hasta la build 70.5.
Descripción:
Se ha identificado una vulnerabilidad en la interfaz de gestión de Citrix Application Delivery Controller (ADC), anteriormente conocida como NetScaler ADC, y Citrix Gateway, anteriormente conocida como NetScaler Gateway.
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/evasion-autentificacion-citrix-application-delivery-controller-y
INCIBE-CERT
Evasión de autentificación en Citrix Application Delivery Controller y Citrix Gateway
Se ha identificado una vulnerabilidad en la interfaz de gestión de Citrix Application Delivery Controller (ADC), anteriormente conocida como NetScaler ADC, y Citrix Gateway, anteriormente conocida como NetScaler Gateway.
Vulnerabilidad de escalada de privilegios en FortiMail de Fortinet
Fecha de publicación: 21/10/2019
Importancia: 4 - Alta
Recursos afectados:
FortiMail, versiones:
6.2.0,
6.0.0 hasta 6.0.6,
5.4.10 y anteriores.
Descripción:
Fortinet ha descubierto dos vulnerabilidades con criticidades altas en FortiMail. Un atacante, con privilegios de administración, podría obtener acceso no autorizado al sistema.
Solución:
Actualizar a las versiones de FortiMail:
6.2.1,
6.0.7,
5.4.11. (pendiente de publicación).
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-escalada-privilegios-fortimail-fortinet
Fecha de publicación: 21/10/2019
Importancia: 4 - Alta
Recursos afectados:
FortiMail, versiones:
6.2.0,
6.0.0 hasta 6.0.6,
5.4.10 y anteriores.
Descripción:
Fortinet ha descubierto dos vulnerabilidades con criticidades altas en FortiMail. Un atacante, con privilegios de administración, podría obtener acceso no autorizado al sistema.
Solución:
Actualizar a las versiones de FortiMail:
6.2.1,
6.0.7,
5.4.11. (pendiente de publicación).
https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-escalada-privilegios-fortimail-fortinet
INCIBE-CERT
Vulnerabilidad de escalada de privilegios en FortiMail de Fortinet
Fortinet ha descubierto dos vulnerabilidades con criticidades altas en FortiMail. Un atacante, con privilegios de administración, podría obtener acceso no autorizado al sistema.
NSA and NCSC Release Joint Advisory on Turla Group Activity
The National Security Agency (NSA) and the United Kingdom National Cyber Security Centre (NCSC) have released a joint advisory on advanced persistent threat (APT) group Turla—widely reported to be Russian. The advisory provides an update to NCSC’s January 2018 report on Turla’s use of the malicious Neuron, Nautilus, and Snake tools to steal sensitive data. Additionally, the advisory states that Turla has compromised—and is currently leveraging—an Iranian APT group’s infrastructure and resources, which include the Neuron and Nautilus tools.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following resources for more information:
• NSA Advisory Turla Group Exploits Iranian APT To Expand Coverage Of Victims
• UK NCSC Advisory Turla group exploits Iranian APT to expand coverage of victims
• January 2018 UK NCSC Report Turla Group Malware
https://www.us-cert.gov/ncas/current-activity/2019/10/21/nsa-and-ncsc-release-joint-advisory-turla-group-activity
The National Security Agency (NSA) and the United Kingdom National Cyber Security Centre (NCSC) have released a joint advisory on advanced persistent threat (APT) group Turla—widely reported to be Russian. The advisory provides an update to NCSC’s January 2018 report on Turla’s use of the malicious Neuron, Nautilus, and Snake tools to steal sensitive data. Additionally, the advisory states that Turla has compromised—and is currently leveraging—an Iranian APT group’s infrastructure and resources, which include the Neuron and Nautilus tools.
The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following resources for more information:
• NSA Advisory Turla Group Exploits Iranian APT To Expand Coverage Of Victims
• UK NCSC Advisory Turla group exploits Iranian APT to expand coverage of victims
• January 2018 UK NCSC Report Turla Group Malware
https://www.us-cert.gov/ncas/current-activity/2019/10/21/nsa-and-ncsc-release-joint-advisory-turla-group-activity
www.us-cert.gov
NSA and NCSC Release Joint Advisory on Turla Group Activity | CISA
The National Security Agency (NSA) and the United Kingdom National Cyber Security Centre (NCSC) have released a joint advisory on advanced persistent threat (APT) group Turla—widely reported to be Russian. The advisory provides an update to NCSC’s January…
#Avast says #CCleaner was targeted by hackers… again
Security firm Avast has revealed that it detected and intercepted suspicious activity on its network. The malicious attack is believed to have been instigated by hackers seeking to target the CCleaner software.
https://betanews.com/2019/10/21/avast-abiss-hack-abiss/
Security firm Avast has revealed that it detected and intercepted suspicious activity on its network. The malicious attack is believed to have been instigated by hackers seeking to target the CCleaner software.
https://betanews.com/2019/10/21/avast-abiss-hack-abiss/
BetaNews
Avast says CCleaner was targeted by hackers... again
Security firm Avast has revealed that it detected and intercepted suspicious activity on its network. The malicious attack is believed to have been instigated by hackers seeking to target the CCleaner software.