FortiGuard Labs has recently observed a detection spike in DVR Authentication Bypass Vulnerability (CVE-2018-9995). This indicates that attackers tried to exploit the vulnerability potentially resulting in attackers gaining unauthorized access to vulnerable DVR devices.Why is this Significant?This is significant because FortiGuard Labs has recently observed increased exploit attempts for unpatched TBK DVR4104 and DVR4216 Digital Video Recorder (DVR) devices as well as rebranded devices. Proof-of-Concept (PoC) code is readily available, and the vulnerability is trivial to exploit.What is CVE-2018-9995?CVE-2018-9995 is an authentication bypass vulnerability that affects DVR4104 and DVR4216 manufactured by TBK and their rebranded devices. The vulnerability is due to an error in the vulnerable application when handling a maliciously crafted HTTP cookie. A remote attacker may be able to exploit this to bypass authentication and obtain administrative access.CVE-2018-9995 has a CVSS basic score of 9.8 and is rated critical by NIST.Has the Vendor Released an Advisory for CVE-2018-9995?FortiGuard Labs is not aware of a vendor advisory.Has the Vendor Released a Patch for CVE-2018-9995?FortiGuard Labs is not aware of a vendor patch for CVE-2018-9995.What is the Status of Protection?FortiGuard Labs has the following IPS signature in place for CVE-2018-9995:DVR.Cookie.Authentication.BypassAny Suggested Mitigation?Configure DVR’s management interface to be accessible only from trusted IPs.

Read More

FortiGuard Labs has recently observed a spike in our detection for the Ruckus Wireless Admin RCE vulnerability (CVE-2023-25717). Ruckus Wireless Admin version 10.4 and earlier are vulnerable affecting multiple Ruckus wireless Access Point (AP) devices. Successful exploitation could result in total compromise of the vulnerable devices.Why is this Significant?This is significant because Fortinet telemetry indicates the Ruckus Wireless Admin RCE Vulnerability (CVE-2023-25717) is being exploited in the wild, potentially resulting in attackers taking control of the vulnerable Ruckus wireless AP devices. Also, Proof-of-Concept (PoC) code is publicly available. As such, a patch should be applied as soon as possible.What is CVE-2023-25717?CVE-2023-25717 is a Remote Code Execution vulnerability that affects Ruckus Wireless Admin version 10.4 and earlier. The advisory published by Ruckus lists multiple wireless Access Point (AP) devices that are susceptible to the vulnerability. Successful exploitation could result in total compromise of the vulnerable devices.The vulnerability is due to improper handling of a crafted HTTP request. A remote authenticated attacker could exploit the vulnerability by sending crafted HTTP requests to the target server. Successful exploitation could result in total compromise of the affected devices. The vulnerability has a CVSS base score of 9.8.Has the Vendor Released an Advisory for CVE-2023-25717?Yes. Please refer to the Appendix for a link to “Security Bulletin 20230208”.Has the Vendor Released a Patch for CVE-2023-25717?Yes, a vendor patch is available.Which Ruckus Devices are Vulnerable to CVE-2023-25717?The list of affected devices is available in the vendor advisory. Please refer to the Appendix for a link to “Security Bulletin 20230208”.What is the Status of the Protection?FortiGuard Labs released the following IPS signature in version 23.531 for CVE-2023-25717:Ruckus.Wireless.Admin.Remote.Code.Execution (default action is set to “pass”)

Read More

FortiGuard Labs is aware of reports that several organizations worldwide downloaded and installed trojanized versions of X_Trader software, which is believed to be the infection vector of the 3CX breach. Some of the reported victims are in critical infrastructure sectors in the United States and Europe. The malicious installers deployed the Veiledsignal backdoor to targeted machines.Why is this Significant?This is significant because several unnamed organizations worldwide, including those in critical infrastructure sector, downloaded and installed malicious versions of the X_Trader software believed to be the attack vector used in the recent 3CX incident. The infection allowed the alleged attacker Lazarus, the infamous North Korean threat actor, to have backdoor access to affected organizations through the deployed Veiledsignal malware.X_Trader software is a trading platform developed by Trading Technologies. How did the Attack Occur?Reports indicate that the trojanized versions of X_Trader software installers were hosted on the official Trading Technologies Web site, which appears to have been compromised in early 2022. CVE-2022-0609 (Use After Free Vulnerability in Google Chrome). was reportedly leveraged in the compromise. The malicious installers are digitally signed using a Trading Technologies’ signing certificate. There is no indication that the installers were actively distributed, rather they had to be manually downloaded and installed.Once the installers are executed, they copy the legitimate X_Trader executable and drop two malicious DLLs that are then sideloaded by the executable. One DLL acts as a loader of the other DLL containing Veiledsignal backdoor payload.Veiledsignal backdoor injects a module into the Chrome, Firefox, or Edge web browsers, which connects to the attacker’s C2 (Command-and-Control) server for commands.What is the Status of Protection?FortiGuard Labs has the following AV signatures in place for the known available trojanized X_Trader installers:Riskware/NukeSpedW32/Sphone_XC3.Q!trFortiGuard Labs has the following AV signatures in place for other known available files used in the attack:W64/NukeSped.PB!trRiskware/NukeSpedW64/BURNTCIGAR.84DB!trW64/ShellcodeRunner.KZ!trW32/Kryptik.F5ED!trW32/Shellcode.RDI!trW64/Agent.203F!trW32/PossibleThreatC2 of of the Veiledsignal backdoor is blocked by Webfiltering.FortiGuard Labs has the following IPS signature in place for CVE-2022-0609:Google.Chrome.UpdateAnimationTiming.Use.After.Free

Read More

It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel did not properly perform filter deactivation in some
situations. A local attacker could possibly use this to gain elevated
privileges. Please note that with the fix for this CVE, kernel support for
the TCINDEX classifier has been removed.

Read More

It was discovered that the Traffic-Control Index (TCINDEX) implementation
in the Linux kernel did not properly perform filter deactivation in some
situations. A local attacker could possibly use this to gain elevated
privileges. Please note that with the fix for this CVE, kernel support for
the TCINDEX classifier has been removed. (CVE-2023-1829)

It was discovered that a race condition existed in the io_uring subsystem
in the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-1872)

Read More

It was discovered that Git incorrectly handled certain commands.
An attacker could possibly use this issue to overwriting some paths.
(CVE-2023-25652)

Maxime Escourbiac and Yassine BENGANA discovered that Git incorrectly
handled some gettext machinery. An attacker could possibly use this issue
to allows the malicious placement of crafted messages. (CVE-2023-25815)

André Baptista and Vítor Pinho discovered that Git incorrectly handled
certain configurations. An attacker could possibly use this issue
to arbitrary configuration injection. (CVE-2023-29007)

Read More