Daily Archives: March 8, 2022

News

International Women’s Day: Career Advice from Women in Tech

Read Time:17 Second

At the Center for Internet Security (CIS), we are proud to have so many talented, passionate, and knowledgeable employees on our team. Their efforts have contributed to our mission of making the connected world a safer place, bringing Confidence in the Connected World. In honor of International Women’s Day, CIS highlights some of these talented […]

Read More

News

Microsoft’s March 2022 Patch Tuesday Addresses 71 CVEs (CVE-2022-23277, CVE-2022-24508)

Read Time:5 Minute, 0 Second

Microsoft addresses 71 CVEs in its March 2022 Patch Tuesday release, including three vulnerabilities that were publicly disclosed as zero-days.

3Critical
68Important
0Moderate
0Low

Microsoft patched 71 CVEs in the March 2022 Patch Tuesday release, with three rated as critical and 68 rated as important.

This month’s update includes patches for:

.NET and Visual Studio
Azure Site Recovery
Microsoft Defender for Endpoint
Microsoft Defender for IoT
Microsoft Edge (Chromium-based)
Microsoft Exchange Server
Microsoft Intune
Microsoft Office Visio
Microsoft Office Word
Microsoft Windows ALPC
Microsoft Windows Codecs Library
Paint 3D
Role: Windows Hyper-V
Skype Extension for Chrome
Tablet Windows User Interface
Visual Studio Code
Windows Ancillary Function Driver for WinSock
Windows CD-ROM Driver
Windows Cloud Files Mini Filter Driver
Windows COM
Windows Common Log File System Driver
Windows DWM Core Library
Windows Event Tracing
Windows Fastfat Driver
Windows Fax and Scan Service
Windows HTML Platform
Windows Installer
Windows Kernel
Windows Media
Windows PDEV
Windows Point-to-Point Tunneling Protocol
Windows Print Spooler Components
Windows Remote Desktop
Windows Security Support Provider Interface
Windows SMB Server
Windows Update Stack
XBox

Remote code execution (RCE) vulnerabilities accounted for 40.8% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 35.2%.

Critical

CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2022-23277 is a critical RCE vulnerability in Microsoft Exchange Server. An authenticated user can exploit this vulnerability to execute arbitrary code on an affected server. According to Microsoft’s Exploitability Index rating, this vulnerability is rated Exploitation More Likely. Threat actors continue to target Exchange servers, particularly through the exploitation of ProxyLogon (CVE-2021-26855), rated as the number one vulnerability in our 2021 Threat Landscape Retrospective. With Exchange vulnerabilities being actively targeted, organizations should prioritize patching this flaw.

Important

CVE-2022-23285 and CVE-2022-21990 | Remote Desktop Client Remote Code Execution Vulnerability

CVE-2022-23285 and CVE-2022-21990 are RCE vulnerabilities in the Remote Desktop Client. Both flaws were assigned a CVSSv3 score of 8.8 and were rated Exploitation More Likely. To exploit these vulnerabilities, an attacker would need to convince a user to connect to a malicious, attacker-controlled server. Successful exploitation would grant an attacker remote code execution on the client’s system, which they could then use to perform a variety of actions, such as installing programs, accessing, modifying or removing data from the system or creating a new account with full privileges.Microsoft notes that CVE-2022-21990 was publicly disclosed prior to a patch being made available.

Important

CVE-2022-24508 | Windows SMBv3 Client/Server Remote Code Execution Vulnerability

CVE-2022-24508 is a RCE vulnerability in the Microsoft Server Message Block 3.0 (SMBv3) Client and Server. Microsoft notes that this vulnerability was introduced in Windows 10 version 2004 so only newer supported versions of Windows are affected. While an attacker must be authenticated to exploit this vulnerability, Microsoft strongly recommends patching or applying the suggested workarounds as soon as possible.

In addition, Microsoft notes that exploitation is more likely for this vulnerability and has provided some recommended actions for protecting networks as well as a workaround that can be utilized for organizations that are not able to immediately patch.

The vulnerability is reminiscent of flaws in SMBv1 patched in MS17-010 in March of 2017. Mass exploitation of that vulnerability was observed in the wild by the WannaCry ransomware, which remains one of the most destructive malware events to date. It remains unclear if CVE-2022-24508 will see exploitation, however patching should be prioritized for all organizations with affected systems.

Important

CVE-2022-24459 | Windows Fax and Scan Service Elevation of Privilege Vulnerability

CVE-2022-24459 is a privilege escalation vulnerability affecting the Windows Fax and Scan service. The vulnerability carries a CVSSv3 score of 7.8 and can be exploited by a local, authenticated attacker. While the severity and requirements for exploitation would typically be less concerning, this vulnerability was publicly disclosed. Given that attackers continue to capitalize on known and proven exploitable vulnerabilities, it’s possible that this flaw could make its way into attackers’ toolkits in the future. Privilege escalation is a common tactic used after an initial compromise or entry to a network by threat actors.

Important

CVE-2022-24512 |.NET and Visual Studio Remote Code Execution Vulnerability

CVE-2022-24512 is a RCE vulnerability affecting Microsoft.NET and Visual Studio which has been publicly disclosed. According to Microsoft, exploitation of this vulnerability requires user interaction to trigger a payload in an affected application. An attacker would likely use social engineering tactics like phishing to influence the necessary user interaction. In addition, the advisory indicates that an attacker would need to combine this with other vulnerabilities in order to successfully exploit a system and that the ability to exploit this vulnerability by itself is limited.

Tenable Solutions

Users can create scans that focus specifically on our Patch Tuesday plugins. From a new advanced scan, in the plugins tab, set an advanced filter for Plugin Name contains March 2022.

With that filter set, click the plugin families to the left and enable each plugin that appears on the right side. Note: If your families on the left say Enabled, then all the plugins in that family are set. Disable the whole family before selecting the individual plugins for this scan. Here’s an example from Tenable.io:

A list of all the plugins released for Tenable’s March 2022 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

Get more information

Microsoft’s March 2022 Security Updates
Tenable plugins for Microsoft March 2022 Patch Tuesday Security Updates

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More

News

McAfee Teammates Share How They’ll Help #BreakTheBias this International Women’s Day

Read Time:2 Minute, 15 Second

International Women’s Day serves as an important reminder that each and every one of us plays a role in recognizing and addressing gender bias. Together, we can make a difference in creating a more equitable world for all.

At McAfee, we know that genuine change requires continuous commitment. And while we’re proud of the efforts we’re making as a company – from being the first cybersecurity company to achieve global pay parity (and maintain it), to expanded time off for new parents, to a woman on every hiring panel to help remove bias – we know there is more to do.

This International Women’s Day and beyond, McAfee team members around the globe share how they’ll continue to advance inclusion and gender equality by actively working to #BreakTheBias.

JaffarSadhik

Software Quality Engineer (India)

A gender equal world starts with a change. A change within families, a change with perspectives, a change among society!

 

 

Arathi

Program Manager (Canada)

I am helping to #BreakTheBias by teaching my son that both boys and girls, men and women can do it all.

 

Krupali

Sr Market Research Analyst (USA)

We need to think differently. Women have, are and will always be quintessential architects of society. Together we can #BreakTheBias

 

Ambareen
Software Engineer (UK)

Collectively we can all #BreakTheBias! I am doing my part and learning from my mum and helping the next generation believe in themselves irrespective of gender.

 

Kevin
Real Estate & Workplace Strategy (Ireland)

Equality can only be achieved if diversity, difference and qualities of woman are truly valued. We must work together to acknowledge and #BreakTheBias.

 

Darya
Channel Marketing (Australia) 

Bias against anyone for simply being different, limits our growth and is a significant waste of talent, energy and happiness. I commit to taking an active role in questioning perceptions to do my part to influence change.

 

Natalia
Software Sales (Canada)

I will help #BreakTheBias by raising and supporting a strong independent young adult and setting an example for her. I do so by choosing my career path while leading and growing personally and professionally!

 

Winnie
Talent Acquisition Partner (Australia)

I will #BreakTheBias by addressing and challenging gender stereotypes. 

 

Aisling
Senior People Partner (Ireland)

I will help #BreakTheBias by encouraging conversations around diversity, challenging myself and others to consider where we can make changes that will have a positive impact.

 

 

Join McAfee and millions of others around the world in celebrating International Women’s Day by sharing how you’ll #BreakTheBias.

Interested in building your career at a company that helps women thrive? Search our openings!

The post McAfee Teammates Share How They’ll Help #BreakTheBias this International Women’s Day appeared first on McAfee Blog.

Read More

News

Google acquires Mandiant to enhance Google Cloud security suite

Read Time:36 Second

Google LLC today announced that it has signed a definitive agreement to acquire Mandiant Inc., a leader in dynamic cyber defense and response. The deal is an all-cash transaction valued at approximately $5.4 billion, inclusive of Mandiant’s net cash, and will see Mandiant join Google Cloud as the latter enhances its security operations suite. The acquisition is subject to customary closing conditions, including the receipt of Mandiant stockholder and regulatory approvals, and is expected to close later this year.

Mandiant acquisition complements Google Cloud’s security offering

The acquisition of Mandiant will complement Google Cloud’s existing security suite, Google said in a press release, which includes:

To read this article in full, please click here

Read More