Ivanti Releases Security Updates for Avalanche, Neurons for ITSM, and Virtual Traffic Manager

Release DateAugust 13, 2024

Ivanti released security updates to address multiple vulnerabilities in Ivanti Avalanche, Neurons for ITSM, and Virtual Traffic Manager (vTM). A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. Ivanti advises users to reduce their attack surface and follow industry best practices by adhering to Ivanti’s network configuration guidance to restrict access to the management interface.

CISA encourages users and administrators to review the following Ivanti advisories and apply the necessary guidance and updates:

Security Advisory: Ivanti Avalanche
Security Advisory: Ivanti Neurons for ITSM
Security Advisory: Ivanti Virtual Traffic Manager (vTM)

https://www.cisa.gov/news-events/alerts/2024/08/13/ivanti-releases-security-updates-avalanche-neurons-itsm-and-virtual-traffic-manager

Adobe Releases Security Updates for Multiple Products

Release DateAugust 14, 2024

Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. 

https://www.cisa.gov/news-events/alerts/2024/08/14/adobe-releases-security-updates-multiple-products

Windows TCP/IP Remote Code Execution Vulnerability

CVE-2024-38063
Security Vulnerability
Released: Aug 13, 2024

CVSS Source: Microsoft
CVSS:3.1 9.8 / 8.5

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063

https://www.bleepingcomputer.com/news/microsoft/zero-click-windows-tcp-ip-rce-impacts-all-systems-with-ipv6-enabled-patch-now/

FreeBSD Project maintainers addressed a high-severity flaw in OpenSSH that could allow remote code execution with elevated privileges.

The maintainers of the FreeBSD Project have released urgent security updates to address a high-severity flaw, tracked as CVE-2024-7589, (CVSS score of 7.4) in OpenSSH. A remote attacker could exploit the vulnerability to execute arbitrary code with elevated privileges.
OpenSSH is an implementation of the SSH protocol suite that offers encrypted and authenticated transport for various services, including remote shell access.

https://securityaffairs.com/166941/security/freebsd-openssh-flaw.html

Industrial Remote Access Tool Ewon Cosy+ Vulnerable to Root Access Attacks

Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks.

https://thehackernews.com/2024/08/industrial-remote-access-tool-ewon-cosy.html

A PoC exploit code is available for critical Ivanti vTM bug

Ivanti warned of a critical authentication bypass flaw in its Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.

Ivanti addressed a critical authentication bypass vulnerability, tracked as CVE-2024-7593 (CVSS score of 9.8), impacting Virtual Traffic Manager (vTM) appliances that can allow attackers to create rogue administrator accounts.

https://securityaffairs.com/166991/hacking/ivanti-virtual-traffic-manager-flaw.html

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593

Remote code execution within ping script (CVE-2024-22116)

CVSS score 9.9
Resolution Fixed

Remote code execution within ping script

Description
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.

https://support.zabbix.com/plugins/servlet/mobile#issue/ZBX-25016

Ejecución de código remoto en Web Help Desk de SolarWinds

Fecha 16/08/2024
Importancia 5 - Crítica

Recursos Afectados
Web Help Desk: versiones 12.4, 12.5, 12.6, 12.7 y 12.8.

Descripción
SolarWinds ha publicado un parche para corregir una vulnerabilidad crítica que afectaría a Web Help Desk.
SolarWinds agradece a Inmarsat Government y Viasat su ayuda en esta vulnerabilidad.

https://www.incibe.es/incibe-cert/alerta-temprana/avisos/ejecucion-de-codigo-remoto-en-web-help-desk-de-solarwinds

WHD 12.8.3 Hotfix 1
All versions of Web Help Desk (WHD) should be upgraded to WHD 12.8.3, and then the hotfix should be installed.

Aug 16, 2024•Success Center

First Published Date
8/13/2024 10:12 PM
Last Published Date
8/16/2024 8:30 PM

Overview
For your protection and to quickly deliver SolarWinds customers a secure version of WHD, we applied an aggressive security patch in WHD 12.8.3 Hotfix 1 on August 13, 2024. In a few cases, this approach impacted product functionality such as SSO. See the known issues for WHD 12.8.3 Hotfix 1.

https://support.solarwinds.com/SuccessCenter/s/article/WHD-12-8-3-Hotfix-1

Múltiples vulnerabilidades en Moodle

Fecha 20/08/2024
Importancia 5 - Crítica

Recursos Afectados
Versiones anteriores que no reciban soporte actualmente y, además:
Versiones 4.4 a 4.4.1;
Versiones 4.3 a 4.3.5;
Versiones 4.2 a 4.2.8;
Versiones 4.1 a 4.1.11.

Descripción
Moodle ha publicado correcciones para 16 vulnerabilidades, 8 de ellas críticas. Su explotación podría permitir ejecución de código remoto, acceso a la información e inyección de código, entre otros.

Dichas vulnerabilidades fueron reportadas por los investigadores: RedTeam Pentesting GmbH, TaiYou, Andrew Lyons, Paul Holden y TeHoFu.

https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-moodle-5

Control de acceso inadecuado en SonicOS de SonicWall

Fecha 26/08/2024
Importancia 5 - Crítica

Recursos Afectados
SOHO (5.ª generación): 5.9.2.14-12o y versiones anteriores.
Gen6 Firewalls (SOHOW, TZ 300, TZ 300W, TZ 400, TZ 400W, TZ 500, TZ 500W, TZ 600, NSA 2650, NSA 3600, NSA 3650, NSA 4600, NSA 4650, NSA 5600, NSA 5650, NSA 6600, NSA 6650, SM 9200, SM 9250, modelos: SM 9400, SM 9450, SM 9600, SM 9650, TZ 300P, TZ 600P, SOHO 250, SOHO 250W, TZ 350, TZ 350W): 6.5.4.14-109n y versiones anteriores.
Gen7 Firewalls: TZ270, TZ270W, TZ370, TZ370W, TZ470, TZ470W, TZ570, TZ570W, TZ570P, TZ670, NSa 2700, NSa 3700, NSa 4700, NSa 5700, NSa 6700, NSsp 10700, NSsp 11700, NSsp 13700: versión de compilación de SonicOS 7.0.1-5035 y versiones anteriores.

Descripción
SonicWall ha publicado una vulnerabilidad podría provocar un acceso no autorizado a recursos y, en condiciones específicas, provocar el bloqueo del firewall.

https://www.incibe.es/incibe-cert/alerta-temprana/avisos/control-de-acceso-inadecuado-en-sonicos-de-sonicwall

VMSA-2024-0018:VMware Fusion update addresses a code execution vulnerability (CVE-2024-38811)

Advisory ID: VMSA-2024-0018
Advisory Severity: Important
CVSSv3 Range: 8.8
Synopsis: VMware Fusion update addresses a code-execution vulnerability (CVE-2024-38811)
Issue date: 2024-09-03
CVE(s): CVE-2024-38811

Impacted Products
VMware Fusion

Introduction
A code-execution vulnerability in VMware Fusion was responsibly reported to VMware. Updates are available to remediate this vulnerability in the affected VMware product.

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24939

D-Link says it is not fixing four RCE flaws in DIR-846W routers

D-Link is warning that four remote code execution (RCE) flaws impacting all hardware and firmware versions of its DIR-846W router will not be fixed as the products are no longer supported.

https://www.bleepingcomputer.com/news/security/d-link-says-it-is-not-fixing-four-rce-flaws-in-dir-846w-routers/

Apache fixes critical OFBiz remote code execution vulnerability

Apache has fixed a critical security vulnerability in its open-source OFBiz (Open For Business) software, which could allow attackers to execute arbitrary code on vulnerable Linux and Windows servers.

https://www.bleepingcomputer.com/news/security/apache-fixes-critical-ofbiz-remote-code-execution-vulnerability/

Veeam Security Bulletin (September 2024)

KB ID: 4649
Product: Veeam Backup & Replication
Veeam ONE
Veeam Service Provider Console
Veeam Agent for Linux
Veeam Backup for Nutanix AHV
Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization
Published: 2024-09-04
Last Modified: 2024-09-05

https://www.veeam.com/kb4649

Microsoft September 2024 Security Updates

https://msrc.microsoft.com/update-guide/releaseNote/2024-Sep

Cisco Releases Security Updates for Cisco Smart Licensing Utility

Release DateSeptember 10, 2024

Cisco released security updates to address two vulnerabilities (CVE-2024-20439 and CVE-2024-20440) in Cisco Smart Licensing Utility. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system.

CISA encourages users and administrators to review the following advisory and apply the necessary updates:

Cisco Smart Licensing Utility Vulnerabilities

https://www.cisa.gov/news-events/alerts/2024/09/10/cisco-releases-security-updates-cisco-smart-licensing-utility

Bug ID(s): CSCwi41731
CVE ID: CVE-2024-20439
Security Impact Rating (SIR): Critical
CVSS Base Score: 9.8

Bug ID(s): CSCwi47950
CVE ID: CVE-2024-20440
Security Impact Rating (SIR): Critical
CVSS Base Score: 9.8

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cslu-7gHMzWmw

Security Advisory EPM September 2024 for EPM 2024 and EPM 2022

Primary Product
Endpoint Manager
Created Date
10-Sep-2024 13:47:00

CVE-2024-37397 8.2 (High)
CVE-2024-8191 7.8 (High)
CVE-2024-32840 9.1 (Critical)
CVE-2024-32842 9.1 (Critical)
CVE-2024-32843 9.1 (Critical)
CVE-2024-32845 9.1 (Critical)
CVE-2024-32846 9.1 (Critical)
CVE-2024-32848 9.1 (Critical)
CVE-2024-34779 9.1 (Critical)
CVE-2024-34783 9.1 (Critical)
CVE-2024-34785 9.1 (Critical)
CVE-2024-8320 5.3 (Medium)
CVE-2024-8321 5.8 (Medium)
CVE-2024-8322 4.3 (Medium)
CVE-2024-29847 10.0 (Critical)
CVE-2024-8441 6.7 (Medium)

https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022

Security Advisory Ivanti Cloud Service Appliance (CSA) (CVE-2024-8190)

Created Date
10-Sep-2024 14:00:02
CVE-2024-8190 7.2 (High)

Affected Versions
Ivanti Cloud Services Appliance (CSA)
CSA 4.6 (All versions before Patch 519)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Service-Appliance-CSA-CVE-2024-8190

Security Advisory Ivanti Workspace Control (IWC)

Created Date
10-Sep-2024 14:04:02

CVE-2024-8012 7.8 (High)
CVE-2024-44105 8.2 (High)
CVE-2024-44104 8.8 (High)
CVE-2024-44107 8.8 (High)
CVE-2024-44103 8.8 (High)
CVE-2024-44106 8.8 (High)

Affected Versions
Ivanti IWC 10.18.0.0 and below

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Workspace-Control-IWC