FortiGuard Labs is aware of a report that a new Medusa malware variant that is targeting Linux-based devices. The Medusa malware is reportedly based on the infamous Mirai malware and is not only capable of launching Distributed Denial of Service (DDoS) attacks and exfiltrating information from compromised devices, but also encrypting files and deleting all files in the system drives.Why is this Significant?This is significant because Medusa botnet supports ransomware functionality and is capable of encrypting files on compromised Linux devices. It also deletes files on the hard disk 24 hours after file encryption is finished, which bricks the affected devices.What is Medusa Malware?Medusa is a Mirai variant that connects to Command-and-Control (C2) servers, and perform various activities upon receiving commands from C2s. Capabilities include – launching DDoS attacks and exfiltrating information from compromised devices. It can also encrypt files on compromised devices and delete all files in the system drives 24 hours after file encryption is completed, which would make the affected devices unusable.While infection chain of Medusa botnet has not been identified, exploiting vulnerabilities is the likely infection vector since Medusa ransomware is reportedly based on the infamous Mirai malware. Bruteforcing is another potential attack vector as Linux devices often have weak username passwords combination by default and users tend not to change default passwords.What is the Status of Protection?FortiGuard Labs has the following AV signatures in place for this attack:Linux/Redis.TSU!trPython/Stealer.DEDC!tr.ransomBAT/Agent.P!tr.dldrFortiGuard Labs has the following IPS signature in place to block download of Medusa malware:Embedded.Linux.Malicious.Script
Yearly Archives: 2023
DSA-5350 firefox-esr – security update
Multiple security issues have been found in the Mozilla Firefox web
browser, which could potentially result in the execution of arbitrary
code, information disclosure or spoofing.
firefox-stable-3720230214124622.1
FEDORA-FLATPAK-2023-603ba8f000
Packages in this update:
firefox-stable-3720230214124622.1
Update description:
Firefox 110.0 release. For details, see https://www.mozilla.org/en-US/firefox/110.0/releasenotes/
apptainer-1.1.6-1.fc37
FEDORA-2023-01ff262091
Packages in this update:
apptainer-1.1.6-1.fc37
Update description:
Update to upstream 1.1.6
apptainer-1.1.6-1.el9
FEDORA-EPEL-2023-5f32ecbc71
Packages in this update:
apptainer-1.1.6-1.el9
Update description:
Update to upstream 1.1.6
apptainer-1.1.6-1.el8
FEDORA-EPEL-2023-b020c7de04
Packages in this update:
apptainer-1.1.6-1.el8
Update description:
Update to upstream 1.1.6
apptainer-1.1.6-1.fc36
FEDORA-2023-677d58bb20
Packages in this update:
apptainer-1.1.6-1.fc36
Update description:
Update to upstream 1.1.6
apptainer-1.1.6-1.el7
FEDORA-EPEL-2023-1eae057392
Packages in this update:
apptainer-1.1.6-1.el7
Update description:
Update to upstream 1.1.6
python-fastapi-0.92.0-1.fc39 python-starlette-0.25.0-1.fc39
FEDORA-2023-6c030b3c71
Packages in this update:
python-fastapi-0.92.0-1.fc39
python-starlette-0.25.0-1.fc39
Update description:
python-starlette 0.25.0
Fixed
Limit the number of fields and files when parsing multipart/form-data on the MultipartParser
python-fastapi 0.92.0
🚨 This is a security fix. Please upgrade as soon as possible.
Upgrades
⬆ Upgrade Starlette to 0.25.0.
This solves a vulnerability that could allow denial of service attacks by using many small multipart fields/files (parts), consuming high CPU and memory.
Only applications using forms (e.g. file uploads) could be affected.
For most cases, upgrading won’t have any breaking changes.
python-fastapi-0.92.0-1.fc38 python-starlette-0.25.0-1.fc38
FEDORA-2023-9d50269499
Packages in this update:
python-fastapi-0.92.0-1.fc38
python-starlette-0.25.0-1.fc38
Update description:
python-starlette 0.25.0
Fixed
Limit the number of fields and files when parsing multipart/form-data on the MultipartParser
python-fastapi 0.92.0
🚨 This is a security fix. Please upgrade as soon as possible.
Upgrades
⬆ Upgrade Starlette to 0.25.0.
This solves a vulnerability that could allow denial of service attacks by using many small multipart fields/files (parts), consuming high CPU and memory.
Only applications using forms (e.g. file uploads) could be affected.
For most cases, upgrading won’t have any breaking changes.