ctk-0.1-0.24.20190721.fc37
dcmtk-3.6.7-1.fc37
OpenImageIO-2.3.18.0-2.fc37
Security fix for CVE-2021-41688, CVE-2021-41690, CVE-2021-41687, CVE-2021-41689
FortiGuard Labs is aware of a report that a new Remote Access Trojan (RAT) called “Woody” has been lurking in the wild for the past year. Reported initial infection vectors include email attachments as well as Microsoft Word documents that leverage the recently patched Follina vulnerability (CVE-2022-30190). Once a victim is infected, Woody RAT collects and sends specific information to its Command-and-Control (C2) server and performs various activities based on the remote commands it receives.Why is this Significant?This is significant because Woody RAT reportedly was used in real world attacks over the past year, yet the malware came to light only recently. Initial infection vectors include leveraging the infamous Follina vulnerability (CVE-2022-30190) in which a patch was released on June 2022 and has been used in various attacks.What is Woody RAT?Woody is a Remote Access Trojan (RAT) that performs activities according to the remote commands it receives from its C2 server.Reported initial infection vectors include email attachments and usage of Microsoft Word that leverages the Follina vulnerability (CVE-2022-30190). In the former case, email attachments are ZIP files containing a Woody RAT executable file, which victims need to run manually to start infection process. In the latter case, victims receive weaponized Microsoft Word files which abuse the MSDT URI scheme to download and run Woody RAT. For reference, FortiGuard Labs previously released an Outbreak Alert and Threat Signal on CVE-2022-30190. See the Appendix for links to “MSDT Follina” and “Follina: 0-day Windows MSDT Vulnerability (CVE-2022-30190) Exploited in The Wild”.Once Woody RAT compromises a victim’s machine, it collects information such as OS, computer name and installed Anti-virus solutions and sends data to its C2 server. The RAT is capable of performing various activities on a compromised machine that include uploading and download files, listing up directories and capturing screenshots upon receiving remote commands.Has the Vendor Released a Patch for the Follina vulnerability (CVE-2022-30190) Used by Woody RAT?Yes. Microsoft released a patch as part of regular June 2022 MS Tuesday patch release.What is the Status of Coverage?FortiGuard Labs detects known Woody RAT and associated samples with the following AV signatures:W32/WoodyRAT.A!trMSOffice/Agent.AAP!trW64/Agent.OS!trW64/Reflo.WD!trMalicious_Behavior.SBPossibleThreat.PALLAS.HW32/PossibleThreatIn relation with CVE-2022-30190, the following signature will detect the retrieval of remote HTML files that contain the MSDT command:MS.Office.MSHTML.Remote.Code.Execution.All network IOCs associated with this attack are blocked by the WebFiltering client.
owncloud-client-2.10.1-1.fc36
Security fix for CVE-2021-44537
firefox-103.0.1-1.fc35
Update to latest upstream (103.0.1)
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Cisco RV340 routers. Authentication is not required to exploit this vulnerability.
Multiple vulnerabilities have been discovered in Cisco Small Business RV Series Routers, the most severe of which could allow for remote code execution. Cisco Small Business RV Series Routers is a series of routers released by Cisco. Successful exploitation of this vulnerability, could allow a user to execute code in the context of the router.
