Daily Archives: August 13, 2024

Advisories

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Read Time:36 Second

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.

Adobe is a software that is used for creating and publishing a wide variety of contents including graphics, photography, illustration, animation, multimedia, motion pictures and print.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights

Read More

News

Six 0-Days Lead Microsoft’s August 2024 Patch Push

Read Time:3 Minute, 38 Second

Microsoft today released updates to fix at least 90 security vulnerabilities in Windows and related software, including a whopping six zero-day flaws that are already being actively exploited by attackers.

Image: Shutterstock.

This month’s bundle of update joy from Redmond includes patches for security holes in Office, .NET, Visual Studio, Azure, Co-Pilot, Microsoft Dynamics, Teams, Secure Boot, and of course Windows itself. Of the six zero-day weaknesses Microsoft addressed this month, half are local privilege escalation vulnerabilities — meaning they are primarily useful for attackers when combined with other flaws or access.

CVE-2024-38106, CVE-2024-38107 and CVE-2024-38193 all allow an attacker to gain SYSTEM level privileges on a vulnerable machine, although the vulnerabilities reside in different parts of the Windows operating system.

Microsoft’s advisories include little information about the last two privilege escalation flaws, other than to note they are being actively exploited. Microsoft says CVE-2024-38106 exists in the Windows Kernel and is being actively exploited, but that it has a high “attack complexity,” meaning it can be tricky for malware or miscreants to exploit reliably.

“Microsoft lists exploit complexity as high due to the attacker needing to win a race condition,” Trend Micro’s ZeroDay Initiative (ZDI) noted. “However, some races are easier to run than others. It’s times like this where the CVSS can be misleading. Race conditions do lead to complexity high in the CVSS score, but with attacks in the wild, it’s clear this bug is readily exploitable.”

Another zero-day this month is CVE-2024-38178, a remote code execution flaw that exists when the built-in Windows Edge browser is operating in “Internet Explorer Mode.” IE mode is not on by default in Edge, but it can be enabled to work with older websites or applications that aren’t supported by modern Chromium-based browsers.

“While this is not the default mode for most users, this exploit being actively exploited suggests that there are occasions in which the attacker can set this or has identified an organization (or user) that has this configuration,” wrote Kev Breen, senior director of threat research at Immersive Labs.

CVE-2024-38213 is a zero-day flaw that allows malware to bypass the “Mark of the Web,” a security feature in Windows that marks files downloaded from the Internet as untrusted (this Windows Smartscreen feature is responsible for the “Windows protected your PC” popup that appears when opening files downloaded from the Web).

“This vulnerability is not exploitable on its own and is typically seen as part of an exploit chain, for example, modifying a malicious document or exe file to include this bypass before sending the file via email or distributing on compromised websites,” Breen said.

The final zero-day this month is CVE-2024-38189, a remote code execution flaw in Microsoft Project. However, Microsoft and multiple security firms point out that this vulnerability only works on customers who have already disabled notifications about the security risks of running VBA Macros in Microsoft Project (not the best idea, as malware has a long history of hiding within malicious Office Macros).

Separately, Adobe today released 11 security bulletins addressing at least 71 security vulnerabilities across a range of products, including Adobe Illustrator, Dimension, Photoshop, InDesign, Acrobat and Reader, Bridge, Substance 3D Stager, Commerce, InCopy, and Substance 3D Sampler/Substance 3D Designer. Adobe says it is not aware of active exploitation against any of the flaws it fixed this week.

It’s a good idea for Windows users to stay current with security updates from Microsoft, which can quickly pile up otherwise. That doesn’t mean you have to install them on Patch Tuesday each month. Indeed, waiting a day or three before updating is a sane response, given that sometimes updates go awry and usually within a few days Microsoft has fixed any issues with its patches. It’s also smart to back up your data and/or image your Windows drive before applying new updates.

For a more detailed breakdown of the individual flaws addressed by Microsoft today, check out the SANS Internet Storm Center’s list. For those admins responsible for maintaining larger Windows environments, it pays to keep an eye on Askwoody.com, which frequently points out when specific Microsoft updates are creating problems for a number of users.

Read More

Advisories

Multiple Vulnerabilities in Ivanti Products Could Allow for Remote Code Execution

Read Time:24 Second

Multiple vulnerabilities have been discovered in Ivanti products, the most severe of which could allow for remote code execution.

Ivanti Avalanche is a mobile device management system.
Ivanti Neurons for ITSM is an IT Service Management Software.
Ivanti Virtual Traffic Manager is a software-based application delivery controller.

Successful exploitation could allow for remote code execution in the context of the system. Depending on the privileges associated with the system, an attacker could then install programs; view, change, or delete data.

Read More

Advisories

Critical Patches Issued for Microsoft Products, August 13, 2024

Read Time:24 Second

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Read More

Advisories

Re: Microsoft PlayReady WMRMECC256 Key / root key issue (attack #5)

Read Time:30 Second

Posted by Security Explorations on Aug 13

Hello All,

In my previous post, I shamefully confused two root keys (WMRMECC256
and ECC256MSBCertRootIssuer) while decribing the issue pertaining to
one of them.

The key exploited in the attack is called ECC256MSBCertRootIssuer Key
(not the WMRMECC256) and is identified by the following public
component:

86 4D 61 CF F2 25 6E 42 2C 56 8B 3C 28 00 1C FB
3E 15 27 65 85 84 BA 05 21 B7 9B 18 28 D9 36 DE
1D 82 6A 8F C3 E6 E7 FA 7A 90 D5 CA 29 46 F1…

Read More

Advisories

USN-6949-2: Linux kernel vulnerabilities

Read Time:4 Minute, 49 Second

Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– ARM32 architecture;
– ARM64 architecture;
– M68K architecture;
– OpenRISC architecture;
– PowerPC architecture;
– RISC-V architecture;
– x86 architecture;
– Block layer subsystem;
– Accessibility subsystem;
– Bluetooth drivers;
– Clock framework and drivers;
– CPU frequency scaling framework;
– Hardware crypto device drivers;
– DMA engine subsystem;
– DPLL subsystem;
– FireWire subsystem;
– EFI core;
– Qualcomm firmware drivers;
– GPIO subsystem;
– GPU drivers;
– Microsoft Hyper-V drivers;
– InfiniBand drivers;
– IOMMU subsystem;
– IRQ chip drivers;
– Macintosh device drivers;
– Multiple devices driver;
– Media drivers;
– EEPROM drivers;
– MMC subsystem;
– Network drivers;
– STMicroelectronics network drivers;
– Device tree and open firmware driver;
– HiSilicon SoC PMU drivers;
– PHY drivers;
– Pin controllers subsystem;
– Remote Processor subsystem;
– S/390 drivers;
– SCSI drivers;
– SPI subsystem;
– Media staging drivers;
– Thermal drivers;
– Userspace I/O drivers;
– USB subsystem;
– DesignWare USB3 driver;
– ACRN Hypervisor Service Module driver;
– Virtio drivers;
– 9P distributed file system;
– BTRFS file system;
– eCrypt file system;
– EROFS file system;
– File systems infrastructure;
– GFS2 file system;
– JFFS2 file system;
– Network file systems library;
– Network file system client;
– Network file system server daemon;
– NILFS2 file system;
– Proc file system;
– SMB network file system;
– Tracing file system;
– Mellanox drivers;
– Memory management;
– Socket messages infrastructure;
– Slab allocator;
– Tracing infrastructure;
– User-space API (UAPI);
– Core kernel;
– BPF subsystem;
– DMA mapping infrastructure;
– RCU subsystem;
– Dynamic debug library;
– KUnit library;
– Maple Tree data structure library;
– Heterogeneous memory management;
– Amateur Radio drivers;
– Bluetooth subsystem;
– Ethernet bridge;
– Networking core;
– IPv4 networking;
– IPv6 networking;
– Multipath TCP;
– Netfilter;
– NET/ROM layer;
– NFC subsystem;
– NSH protocol;
– Open vSwitch;
– Phonet protocol;
– SMC sockets;
– TIPC protocol;
– Unix domain sockets;
– Wireless networking;
– Key management;
– ALSA framework;
– HD-audio driver;
– Kirkwood ASoC drivers;
– MediaTek ASoC drivers;
(CVE-2024-36006, CVE-2024-36922, CVE-2024-38567, CVE-2024-38584,
CVE-2024-36923, CVE-2024-36892, CVE-2024-35855, CVE-2024-35853,
CVE-2024-38562, CVE-2024-36920, CVE-2024-38543, CVE-2024-38576,
CVE-2024-38572, CVE-2024-36898, CVE-2024-38560, CVE-2024-36004,
CVE-2024-36956, CVE-2024-36881, CVE-2024-36977, CVE-2024-36955,
CVE-2024-36906, CVE-2024-36013, CVE-2024-36884, CVE-2024-38563,
CVE-2024-36966, CVE-2024-38547, CVE-2024-38594, CVE-2024-36926,
CVE-2024-38587, CVE-2024-38566, CVE-2024-27400, CVE-2024-36941,
CVE-2024-36017, CVE-2024-38544, CVE-2024-36899, CVE-2024-35851,
CVE-2024-38577, CVE-2024-38590, CVE-2024-38568, CVE-2024-38559,
CVE-2024-38611, CVE-2024-36887, CVE-2024-36886, CVE-2024-35996,
CVE-2024-38612, CVE-2024-36925, CVE-2024-38586, CVE-2024-38596,
CVE-2024-36932, CVE-2024-39482, CVE-2024-38585, CVE-2024-36033,
CVE-2024-38614, CVE-2024-35852, CVE-2024-36908, CVE-2024-36939,
CVE-2024-36963, CVE-2024-27401, CVE-2024-36029, CVE-2024-38540,
CVE-2024-38565, CVE-2024-36927, CVE-2024-36910, CVE-2024-42134,
CVE-2024-36888, CVE-2024-35859, CVE-2024-36911, CVE-2024-35947,
CVE-2024-36940, CVE-2024-36921, CVE-2024-36913, CVE-2024-36943,
CVE-2024-35986, CVE-2024-38616, CVE-2024-36900, CVE-2024-36954,
CVE-2024-36915, CVE-2024-38602, CVE-2024-41011, CVE-2024-35991,
CVE-2024-36909, CVE-2024-38603, CVE-2023-52882, CVE-2024-36953,
CVE-2024-38599, CVE-2024-38574, CVE-2024-36967, CVE-2024-36895,
CVE-2024-36003, CVE-2024-36961, CVE-2024-38545, CVE-2024-38538,
CVE-2024-36001, CVE-2024-36912, CVE-2024-36952, CVE-2024-38550,
CVE-2024-38570, CVE-2024-36969, CVE-2024-38595, CVE-2024-35849,
CVE-2024-36936, CVE-2024-35949, CVE-2024-36009, CVE-2024-35987,
CVE-2024-38541, CVE-2024-38564, CVE-2024-36032, CVE-2024-38615,
CVE-2024-36960, CVE-2024-36934, CVE-2024-36951, CVE-2024-35999,
CVE-2024-38551, CVE-2024-36903, CVE-2024-36931, CVE-2024-38593,
CVE-2024-36938, CVE-2024-38607, CVE-2024-36928, CVE-2024-38552,
CVE-2024-36002, CVE-2024-38605, CVE-2024-38582, CVE-2024-36933,
CVE-2024-38620, CVE-2024-27395, CVE-2024-27396, CVE-2024-36012,
CVE-2024-38591, CVE-2024-38597, CVE-2024-36889, CVE-2024-36964,
CVE-2024-38606, CVE-2024-38553, CVE-2024-36945, CVE-2024-35848,
CVE-2024-36962, CVE-2024-36947, CVE-2024-27399, CVE-2024-38546,
CVE-2024-38583, CVE-2024-38573, CVE-2024-35850, CVE-2024-38549,
CVE-2024-38588, CVE-2024-38610, CVE-2024-36917, CVE-2024-36957,
CVE-2024-35846, CVE-2024-38579, CVE-2024-36965, CVE-2024-35857,
CVE-2024-38548, CVE-2024-36975, CVE-2024-36919, CVE-2024-38542,
CVE-2024-36948, CVE-2024-36011, CVE-2024-38556, CVE-2024-36897,
CVE-2024-38557, CVE-2024-36890, CVE-2024-36882, CVE-2024-38613,
CVE-2024-36914, CVE-2024-35998, CVE-2024-36958, CVE-2024-38580,
CVE-2024-36896, CVE-2024-36891, CVE-2024-36924, CVE-2024-38589,
CVE-2024-38592, CVE-2024-36904, CVE-2024-36894, CVE-2024-36028,
CVE-2024-36014, CVE-2024-36880, CVE-2024-36944, CVE-2024-38598,
CVE-2024-36929, CVE-2024-36883, CVE-2024-35858, CVE-2024-38555,
CVE-2024-36005, CVE-2024-38539, CVE-2024-35994, CVE-2024-36030,
CVE-2024-27394, CVE-2024-36930, CVE-2024-36937, CVE-2024-38561,
CVE-2024-38578, CVE-2024-36959, CVE-2024-36935, CVE-2024-36916,
CVE-2024-36902, CVE-2024-38604, CVE-2024-38554, CVE-2024-38575,
CVE-2024-36918, CVE-2024-36979, CVE-2024-35854, CVE-2024-36968,
CVE-2024-38558, CVE-2024-36000, CVE-2024-27398, CVE-2024-35983,
CVE-2024-36949, CVE-2024-38600, CVE-2024-36950, CVE-2024-36946,
CVE-2024-36031, CVE-2024-35847, CVE-2024-36905, CVE-2024-38571,
CVE-2024-36007, CVE-2024-35856, CVE-2024-38601, CVE-2024-38569,
CVE-2024-38617, CVE-2024-35988, CVE-2024-35989, CVE-2024-35993,
CVE-2024-36893, CVE-2024-36901)

Read More

News

The AI Fix #11: AI gods, a robot dentist, and an angry human

Read Time:27 Second

In episode 11 of The AI Fix, OpenAI battles a Shakespearean lawyer, Graham sings an uncanny bluegrass acrostic, Google drops the ball with a terrible AI ad, and Mark wonders why there’s no sound on a video of an AI dentist.

Graham finds religion with a little help from a man named “L Ron”, a traffic cone saves the world, and Mark has a heated argument with belligerent ChatGPT.

All this and much more is discussed in the latest edition of “The AI Fix” podcast by Graham Cluley and Mark Stockley.

Read More

Advisories

USN-6958-1: Libcroco vulnerabilities

Read Time:38 Second

It was discovered that Libcroco was incorrectly accessing data structures
when reading bytes from memory, which could cause a heap buffer overflow.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960)

It was discovered that Libcroco was incorrectly handling invalid UTF-8
values when processing CSS files. An attacker could possibly use this
issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)

It was discovered that Libcroco was incorrectly implementing recursion in
one of its parsing functions, which could cause an infinite recursion
loop and a stack overflow due to stack consumption. An attacker could
possibly use this issue to cause a denial of service. (CVE-2020-12825)

Read More