Read Time:3 Second
An unauthorized party caused the intermittent redirection of customer websites
Monthly Archives: February 2023
plasma-workspace-5.27.0-4.fc37
Read Time:9 Second
FEDORA-2023-3b1fdbdfa1
Packages in this update:
plasma-workspace-5.27.0-4.fc37
Update description:
Add patch to disable global shortcuts at login for the SDDM Plasma Wayland configuration (#2171332)
Frebniis Malware Exploits Microsoft IIS Feature
Read Time:4 Second
The malware was used by a previously unknown threat actor against targets in Taiwan
CVE-2021-33621: A Critical Security Vulnerability in Ruby’s CGI
Read Time:1 Minute, 24 Second
A critical security vulnerability, known as CVE-2021-33621, has been discovered in Ruby’s Common Gateway Interface (CGI) that could potentially put millions of users at risk. In this article, we’ll explore what CVE-2021-33621 is, what it affects, its CVSS score, and how you can protect yourself from it.
What is CVE-2021-33621?
CVE-2021-33621 is a security vulnerability in Ruby’s CGI that allows HTTP header injection and response splitting. This vulnerability could potentially be exploited by attackers to perform cross-site scripting (XSS) attacks, steal sensitive data, or execute arbitrary code on a user’s system.
What does CVE-2021-33621 affect?
According to the Ruby vendor’s website, the vulnerability affects applications that use the CGI module and are running the following versions:
- cgi gem 0.3.3 or earlier
- cgi gem 0.2.1 or earlier
- cgi gem 0.1.1, 0.1.0.1, or 0.1.0
CVSS Score: The CVSS score for CVE-2021-33621 is 9.8, indicating that it is a critical vulnerability that requires immediate attention.
References: You can find more information about CVE-2021-33621 on the MITRE website (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33621) and the software vendor’s website.
How can you protect yourself from CVE-2021-33621?
To protect yourself from this vulnerability, it is recommended that you review your code to ensure that untrusted input is not being passed to any CGI functions. It is also recommended that you upgrade to a patched version of Ruby as soon as possible. You can find more information about the vulnerability and the patches on the MITRE website and the Ruby vendor’s website.
Understanding and Mitigating the CVE-2022-41741 Vulnerability in NGINX
Read Time:1 Minute, 48 Second
NGINX, a widely-used open-source web server, has recently been affected by a critical vulnerability – CVE-2022-41741. The vulnerability is specific to NGINX’s module, ngx_http_mp4_module, and can be exploited by a local attacker to corrupt NGINX worker memory resulting in its termination. In this article, we will explain the details of the CVE-2022-41741 vulnerability and provide guidance on how to mitigate the risk.
What is CVE-2022-41741?
CVE-2022-41741 is a vulnerability in NGINX’s module, ngx_http_mp4_module. The vulnerability allows a local attacker to corrupt NGINX worker memory, which can cause its termination or other potential impact, using a specially crafted audio or video file. The attack can be executed only when the mp4 directive is used in the configuration file of NGINX products built with the ngx_http_mp4_module.
What does CVE-2022-41741 affect?
The CVE-2022-41741 vulnerability in NGINX can have a significant impact on the security and stability of the web server. If exploited, the vulnerability can cause NGINX to crash, resulting in downtime and a loss of availability. Furthermore, attackers can also gain access to sensitive information stored in the system by exploiting the vulnerability.
How can you protect yourself from CVE-2022-41741?
To mitigate the risk of CVE-2022-41741, users of NGINX products built with the ngx_http_mp4_module should update their software to the latest version. NGINX Open Source before versions 1.23.2 and 1.22.1, NGINX Open Source Subscription before versions R2 P1 and R1 P1, and NGINX Plus before versions R27 P1 and R26 P1 are all vulnerable to this CVE-2022-41741 vulnerability. Therefore, updating to the latest version will address the vulnerability and prevent attackers from exploiting it.
In summary, the CVE-2022-41741 vulnerability in NGINX’s module, ngx_http_mp4_module, can have severe consequences if exploited. However, updating to the latest version of NGINX will mitigate the risk and prevent attackers from exploiting this vulnerability. Therefore, it is essential to ensure that the web server is updated as soon as possible to avoid any potential security risks.
As Twitter forces users to remove text message 2FA, it’s in danger of decreasing security
Read Time:16 Second
Many Twitter users have been presented with a message telling them that SMS-based two-factor authentication (2FA) will be removed next month.
According to Twitter, only subscribers to its premium Twitter Blue service will be able to use text message-based 2FA to protect their accounts.
Is that such a good idea?
Fines as a Security System
Read Time:1 Minute, 15 Second
Tile has an interesting security solution to make its tracking tags harder to use for stalking:
The Anti-Theft Mode feature will make the devices invisible to Scan and Secure, the company’s in-app feature that lets you know if any nearby Tiles are following you. But to activate the new Anti-Theft Mode, the Tile owner will have to verify their real identity with a government-issued ID, submit a biometric scan that helps root out fake IDs, agree to let Tile share their information with law enforcement and agree to be subject to a $1 million penalty if convicted in a court of law of using Tile for criminal activity. So although it technically makes the device easier for stalkers to use Tiles silently, it makes the penalty of doing so high enough to (at least in theory) deter them from trying.
Interesting theory. But it won’t work against attackers who don’t have any money.
Hulls believes the approach is superior to Apple’s solution with AirTag, which emits a sound and notifies iPhone users that one of the trackers is following them.
My complaint about the technical solutions is that they only work for users of the system. Tile security requires an “in-app feature.” Apple’s AirTag “notifies iPhone users.” What we need is a common standard that is implemented on all smartphones, so that people who don’t use the trackers can be alerted if they are being surveilled by one of them.
FBI “Contains” Cyber-Incident on its Network
GoDaddy connects a slew of past attacks to a multiyear hacking campaign
Read Time:41 Second
Web hosting and infrastructure provider GoDaddy said it suspects a recent attack on its infrastructure in December 2022 may be connected to a series of incidents the business has been experiencing since 2020.
The attack involved an unauthorized third-party gaining access to and installing malware on GoDaddy’s cPanel hosting servers, the company disclosed in an SEC filing. The company only discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains.
“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the filing added.
GoDaddy connects a slew of past attacks to a multi-year hacking campaign
Read Time:41 Second
Web hosting and infrastructure provider GoDaddy said it suspects a recent attack on its infrastructure in December 2022 may be connected to a series of incidents the business has been experiencing since 2020.
The attack involved an unauthorized third-party gaining access to and installing malware on GoDaddy’s cPanel hosting servers, the company disclosed in an SEC filing. The company only discovered the security breach following customer reports in early December 2022 that their sites were being used to redirect to random domains.
“Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the filing added.