The CIS Benchmarks development team has been hard at work preparing several brand new Benchmarks and updates for April 2022.

Read More

VMware cautions organizations to patch or mitigate several serious vulnerabilities across multiple products.

Background

On April 6, VMware published an advisory (VMSA-2022-0011) addressing eight vulnerabilities across a number of VMware products:

Affected products include:

VMware Workspace ONE Access (Access)
VMware Identity Manager (vIDM)
VMware vRealize Automation (vRA)
VMware Cloud Foundation
vRealize Suite Lifecycle Manager

All eight vulnerabilities were disclosed to VMware by Steven Seeley, a security researcher with Qihoo 360 Vulnerability Research Institute.

Analysis

CVE-2022-22954 is a server-side template injection vulnerability in the VMware Workspace ONE Access and Identity Manager. This vulnerability was assigned a CVSSv3 score of 9.8. An unauthenticated attacker with network access could exploit this vulnerability by sending a specially crafted request to a vulnerable VMware Workspace ONE or Identity Manager. Successful exploitation could result in remote code execution by exploiting a server-side template injection flaw.

CVE-2022-22955 and CVE-2022-22956 are a pair of authentication bypass vulnerabilities in the OAuth 2.0 Access Control Services (ACS) framework within VMware Workspace ONE. Both of these vulnerabilities were assigned a CVSSv3 score of 9.8. An unauthenticated attacker could send specially crafted requests to vulnerable and exposed OAuth2.0 endpoints in VMware Workspace ONE in order to successfully authenticate to the Workspace ONE instance.

These three vulnerabilities are the only ones patched in this advisory that do not require authentication prior to exploitation. The remaining five do, and as such, have been assigned lower CVSSv3 scores.

Russian state-sponsored actors have targeted VMware Workspace ONE in the past

In December 2020, the National Security Agency revealed that Russian state-sponsored threat actors had exploitedCVE-2020-4006, a command injection flaw in the administrative configurator component across a number of VMware products including Workspace ONE Access, Identity Manager, Cloud Foundation and vRealize Suite Lifecycle Manager.

While the vulnerabilities in VMSA-2022-0011 were addressed as part of a coordinated disclosure, attackers do routinely target legacy vulnerabilities.

Proof of concept

At the time this blog post was published, no proof-of-concept exploits had been shared for any of the vulnerabilities.

Solution

VMware released patches for the vulnerabilities in the following affected products:

VMware urges organizations to take immediate action

As part of an FAQ document for VMSA-2022-0011, VMware has stressed that these vulnerabilities “should be patched or mitigated immediately” and that the “ramifications” are “serious.” If patching these flaws is not feasible, VMware has also shared workaround instructions as a temporary solution, but states that patching is the only way to remove these flaws entirely

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released.

Get more information

VMWare Advisory: VMSA-2022-0011
VMware VMSA-2022-0011 FAQ
Workaround Instructions for VMSA-2022-0011

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Read More

Cybersecurity vendors CrowdStrike and Mandiant have announced a strategic partnership to help joint customers investigate, remediate and defend against increasingly sophisticated cybersecurity events. In the collaboration, Mandiant will use the CrowdStrike Falcon endpoint protection platform and subscription offerings for its incident response services and proactive consulting engagements, the firms said in a press release. Furthermore, the Mandiant Managed Defense offering intends to include support for customers leveraging the Falcon platform later this year.

To read this article in full, please click here

Read More

A statement allegedly from Gazprom CEO Alexie Miller was briefly displayed on the website

Read More

The bank was fined for the breaches and the delays in communicating with affected customers

Read More

The Justice Department announced the disruption of a Russian GRU-controlled botnet:

The Justice Department today announced a court-authorized operation, conducted in March 2022, to disrupt a two-tiered global botnet of thousands of infected network hardware devices under the control of a threat actor known to security researchers as Sandworm, which the U.S. government has previously attributed to the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation (the GRU). The operation copied and removed malware from vulnerable internet-connected firewall devices that Sandworm used for command and control (C2) of the underlying botnet. Although the operation did not involve access to the Sandworm malware on the thousands of underlying victim devices worldwide, referred to as “bots,” the disabling of the C2 mechanism severed those bots from the Sandworm C2 devices’ control.

The botnet “targets network devices manufactured by WatchGuard Technologies Inc. (WatchGuard) and ASUSTek Computer Inc. (ASUS).” And note that only the command-and-control mechanism was disrupted. Those devices are still vulnerable.

The Justice Department made a point that they did this before the botnet was used for anything offensive.

Four more news articles. Slashdot post.

Read More

A new report shows that not only has there been a substantial increase in the percentage of companies that pay ransoms, but that the average size of ransomware payments has also increased significantly.

Read more in my article on the Tripwire State of Security blog.

Read More