The malware was used by a previously unknown threat actor against targets in Taiwan
Daily Archives: February 20, 2023
CVE-2021-33621: A Critical Security Vulnerability in Ruby’s CGI
A critical security vulnerability, known as CVE-2021-33621, has been discovered in Ruby’s Common Gateway Interface (CGI) that could potentially put millions of users at risk. In this article, we’ll explore what CVE-2021-33621 is, what it affects, its CVSS score, and how you can protect yourself from it.
What is CVE-2021-33621?
CVE-2021-33621 is a security vulnerability in Ruby’s CGI that allows HTTP header injection and response splitting. This vulnerability could potentially be exploited by attackers to perform cross-site scripting (XSS) attacks, steal sensitive data, or execute arbitrary code on a user’s system.
What does CVE-2021-33621 affect?
According to the Ruby vendor’s website, the vulnerability affects applications that use the CGI module and are running the following versions:
- cgi gem 0.3.3 or earlier
- cgi gem 0.2.1 or earlier
- cgi gem 0.1.1, 0.1.0.1, or 0.1.0
CVSS Score: The CVSS score for CVE-2021-33621 is 9.8, indicating that it is a critical vulnerability that requires immediate attention.
References: You can find more information about CVE-2021-33621 on the MITRE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33621) and the software vendor’s website.
How can you protect yourself from CVE-2021-33621?
To protect yourself from this vulnerability, it is recommended that you review your code to ensure that untrusted input is not being passed to any CGI functions. It is also recommended that you upgrade to a patched version of Ruby as soon as possible. You can find more information about the vulnerability and the patches on the MITRE website and the Ruby vendor’s website.
Understanding and Mitigating the CVE-2022-41741 Vulnerability in NGINX
NGINX, a widely-used open-source web server, has recently been affected by a critical vulnerability – CVE-2022-41741. The vulnerability is specific to NGINX’s module, ngx_http_mp4_module, and can be exploited by a local attacker to corrupt NGINX worker memory resulting in its termination. In this article, we will explain the details of the CVE-2022-41741 vulnerability and provide guidance on how to mitigate the risk.
What is CVE-2022-41741?
CVE-2022-41741 is a vulnerability in NGINX’s module, ngx_http_mp4_module. The vulnerability allows a local attacker to corrupt NGINX worker memory, which can cause its termination or other potential impact, using a specially crafted audio or video file. The attack can be executed only when the mp4 directive is used in the configuration file of NGINX products built with the ngx_http_mp4_module.
What does CVE-2022-41741 affect?
The CVE-2022-41741 vulnerability in NGINX can have a significant impact on the security and stability of the web server. If exploited, the vulnerability can cause NGINX to crash, resulting in downtime and a loss of availability. Furthermore, attackers can also gain access to sensitive information stored in the system by exploiting the vulnerability.
How can you protect yourself from CVE-2022-41741?
To mitigate the risk of CVE-2022-41741, users of NGINX products built with the ngx_http_mp4_module should update their software to the latest version. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 are all vulnerable to this CVE-2022-41741 vulnerability. Therefore, updating to the latest version will address the vulnerability and prevent attackers from exploiting it.
In summary, the CVE-2022-41741 vulnerability in NGINX’s module, ngx_http_mp4_module, can have severe consequences if exploited. However, updating to the latest version of NGINX will mitigate the risk and prevent attackers from exploiting this vulnerability. Therefore, it is essential to ensure that the web server is updated as soon as possible to avoid any potential security risks.
As Twitter forces users to remove text message 2FA, it’s in danger of decreasing security
Many Twitter users have been presented with a message telling them that SMS-based two-factor authentication (2FA) will be removed next month.
According to Twitter, only subscribers to its premium Twitter Blue service will be able to use text message-based 2FA to protect their accounts.
Is that such a good idea?
Fines as a Security System
Tile has an interesting security solution to make its tracking tags harder to use for stalking:
The Anti-Theft Mode feature will make the devices invisible to Scan and Secure, the company’s in-app feature that lets you know if any nearby Tiles are following you. But to activate the new Anti-Theft Mode, the Tile owner will have to verify their real identity with a government-issued ID, submit a biometric scan that helps root out fake IDs, agree to let Tile share their information with law enforcement and agree to be subject to a $1 million penalty if convicted in a court of law of using Tile for criminal activity. So although it technically makes the device easier for stalkers to use Tiles silently, it makes the penalty of doing so high enough to (at least in theory) deter them from trying.
Interesting theory. But it won’t work against attackers who don’t have any money.
Hulls believes the approach is superior to Apple’s solution with AirTag, which emits a sound and notifies iPhone users that one of the trackers is following them.
My complaint about the technical solutions is that they only work for users of the system. Tile security requires an “in-app feature.” Apple’s AirTag “notifies iPhone users.” What we need is a common standard that is implemented on all smartphones, so that people who don’t use the trackers can be alerted if they are being surveilled by one of them.
FBI “Contains” Cyber-Incident on its Network
GoDaddy connects a slew of past attacks to a multiyear hacking campaign
Web hosting and infrastructure provider GoDaddy said it suspects a recent attack on its infrastructure in December 2022 may be connected to a series of incidents the business has been experiencing since 2020.
The attack involved an unauthorized third-party gaining access to and installing malware on GoDaddy’s cPanel hosting servers, the company disclosed in an SEC filing. The company only discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains.
“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the filing added.
GoDaddy connects a slew of past attacks to a multi-year hacking campaign
Web hosting and infrastructure provider GoDaddy said it suspects a recent attack on its infrastructure in December 2022 may be connected to a series of incidents the business has been experiencing since 2020.
The attack involved an unauthorized third-party gaining access to and installing malware on GoDaddy’s cPanel hosting servers, the company disclosed in an SEC filing. The company only discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains.
“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the filing added.
CVE-2016-15026
A vulnerability was found in 3breadt dd-plist 1.17 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. An attack has to be approached locally. Upgrading to version 1.18 is able to address this issue. The name of the patch is 8c954e8d9f6f6863729e50105a8abf3f87fff74c. It is recommended to upgrade the affected component. VDB-221486 is the identifier assigned to this vulnerability.