Posted by YEUNG, Tsz Ko on Feb 28

Hi all,

I would like to disclose a vulnerability that I just found today.

Details below:

Vulnerable Software and Version:

1. Rufus 3.17.1846 executable
2. Rufus 3.17.1846 portable executable

Vulnerable software download link:
https://rufus.ie/en/

https://github.com/pbatard/rufus/releases/tag/v3.17

Date discovered and reported:
25 Feb 2022

Description:
Both Rufus 3.17.1846 executable AND portable executable are suffering from DLL…

Read More

Gaoning Pan discovered that QEMU incorrectly handled the floppy disk
emulator. An attacker inside the guest could use this issue to cause QEMU
to crash, resulting in a denial of service. (CVE-2021-20196)

Gaoning Pan discovered that the QEMU vmxnet3 NIC emulator incorrectly
handled certain values. An attacker inside the guest could use this issue
to cause QEMU to crash, resulting in a denial of service. (CVE-2021-20203)

It was discovered that the QEMU vhost-user GPU device contained several
security issues. An attacker inside the guest could use these issues to
cause QEMU to crash, resulting in a denial of service, leak sensitive
information, or possibly execute arbitrary code. This issue only affected
Ubuntu 21.10. (CVE-2021-3544, CVE-2021-3545, CVE-2021-3546)

It was discovered that QEMU incorrectly handled bulk transfers from SPICE
clients. A remote attacker could use this issue to cause QEMU to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2021-3682)

It was discovered that the QEMU UAS device emulation incorrectly handled
certain stream numbers. An attacker inside the guest could use this issue
to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 21.10.
(CVE-2021-3713)

It was discovered that the QEMU virtio-net device incorrectly handled
certain buffer addresses. An attacker inside the guest could use this issue
to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code. (CVE-2021-3748)

It was discovered that the QEMU SCSI device emulation incorrectly handled
certain MODE SELECT commands. An attacker inside the guest could possibly
use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2021-3930)

It was discovered that the QEMU ACPI logic incorrectly handled certain
values. An attacker inside the guest could possibly use this issue to cause
QEMU to crash, resulting in a denial of service. This issue only affected
Ubuntu 21.10. (CVE-2021-4158)

Jietao Xiao, Jinku Li, Wenbo Shen, and Nanzi Yang discovered that the QEMU
virtiofsd device incorrectly handled permissions when creating files. An
attacker inside the guest could use this issue to create files inside the
directory shared by virtiofs with unintended permissions, possibly allowing
privilege escalation. This issue only affected Ubuntu 21.10.
(CVE-2022-0358)

Read More

A large number of security issues were discovered in the WebKitGTK Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.

Read More

Several security issues were discovered in MariaDB and this update includes
new upstream MariaDB versions to fix these issues.

MariaDB has been updated to 10.3.34 in Ubuntu 20.04 LTS and to 10.5.15 in
Ubuntu 21.10.

In addition to security fixes, the updated packages contain bug fixes,
new features, and possibly incompatible changes.

Read More

It was discovered that PHP incorrectly handled certain scripts.
An attacker could possibly use this issue to cause a denial of service,
or possibly execute arbitrary code.

Read More

Kevin Backhouse discovered that PolicyKit incorrectly handled file
descriptors. A local attacker could possibly use this issue to cause
PolicyKit to crash, resulting in a denial of service.

Read More

The 15Zine WordPress theme before 3.3.0 does not sanitise and escape the cbi parameter before outputing it back in the response via the cb_s_a AJAX action, leading to a Reflected Cross-Site Scripting

Read More

FortiGuard Labs is aware of a report by Pangu Lab that a new Linux backdoor malware that reportedly belongs to the Equation group was used to potentially compromise more than 200 organizations across over 40 countries around the globe. The Equation group is regarded as one of the most highly skilled threat actors, which some speculate have close connections with National Security Agency (NSA). The threat actor is also reported have been tied to the Stuxnet malware that was used in 2010 cyber attack on a nuclear centrifuge facility in Iran.Why is this Significant?Bvp47 is a previously undiscovered backdoor malware that was reportedly used in cyber attacks carried out by the Equation group. According to the report and information available in the documents that presumably leaked from the Equation group, over 200 organizations spread across more than 40 countries may have been infected with the Bvp47 malware.The Bvp47 file called out in the report was first submitted to VirusTotal in late 2013, which indicates that Bvp47 was used and undiscovered for close to a decade.How was the Connection between the Bvp47 malware and the Equation Group Established?Pangu Lab concluded that Bvp47 belongs to the Equation group because one of the folders included in the documents leaked by the Shadow Brokers in 2017 contained a RSA private key required by Bvp47 for its command execution and other operations.What is the Shadow Brokers?The Shadow Brokers is a threat actor who claimed to have stolen highly classified information from the Equation group in 2016. The stolen information includes zero-day exploits, operation manuals and description of tools used by the Equation group. The Shadow Brokers then attempted to sell the information to the highest bidder. After no one purchased the information, The threat actor released the information to the public after the auction attempt failed.One of the most famous exploits included in the leaked documents is EternalBlue. Within a few weeks of the leak, EternalBlue was incorporated in Wannacry ransomware which caused global panic in 2017.What are the Characteristics of Bvp47?Bvp is a Linux backdoor that performs actions upon receiving commands from Command and Control (C2) servers.Because the Bvp47 framework is incorporated with components such as “dewdrops” and “solutionchar_agents” that are included in the Shadow Brokers leaks, the backdoor is for mainstream Linux distributions, FreeBSD, Solaris as well as JunOS,.Bvp47 also runs various environment checks. If the requirements are not met, the malware deletes itself.What is the Status of Coverage?FortiGuard Labs provide the following AV coverage against Bvp47:ELF/Agent.16DC!tr

Read More

FortiGuard Labs is aware that F5 released a security advisory on August 24th about vulnerabilities affecting multiple versions of BIG-IP and BIG-IQ. The US Cybersecurity and Infrastructure Security Agency (CISA) published an advisory the next day urging the customers to apply the fixes or put necessary mitigations in place. Of the 13 vulnerabilities that are rated high by the vendor, CVE-2021-23031 is given the highest CVSS score of 8.8 out of 10 and affects BIG-IP Advanced WAF and Application Security Manager (ASM). When abused, the vulnerability allows “an authenticated attacker with access to the Configuration utility can execute arbitrary system commands, create or delete files, and/or disable services,” which may result in the attack gaining complete control of the system. However, the CVSS score and rating jumps to 9.9 and Critical, respectively, when the products are running in Appliance mode. As Appliance mode is described as ” designed to meet the needs of customers in especially sensitive sectors”, CVE-2021-23031 requires additional attention and care.When Did the Vendor Post the Advisory?The vendor released the advisory on August 24th, 2021.What is the Breakdown of the Advisory?The advisory has 13 high vulnerabilities, 15 medium vulnerabilities, 1 low vulnerability and 6 security exposures affecting multiple versions of BIG-IP and BIG-IQ. However, high rating for CVE-2021-23031 is elevated to critical when the affected products are running in Appliance mode.For more details, see the Appendix for a link to “K50974556: Overview of F5 vulnerabilities (August 2021)”What is the Result of Successful Exploitation of CVE-2021-23031?Successful exploitation allows “an authenticated attacker with access to the Configuration utility can execute arbitrary system commands, create or delete files, and/or disable services.” In the worst case scenario, the vulnerability enables the attack to take complete control of the system.What are the Technical Details of CVE-2021-23031?The advisory does not offer much technical details, nor why there are two separate ratings for the vulnerability other than the 9.9 rating applies to “the limited number of customers using Appliance mode.”For more details, see the Appendix for a link to “K41351250: BIG-IP Advanced WAF and BIG-IP ASM vulnerability CVE-2021-23031″What is Appliance Mode?The following is provided by F5 in regard with Appliance mode:BIG-IP systems have the option of running in Appliance mode. Appliance mode is designed to meet the needs of customers in especially sensitive sectors by limiting the BIG-IP system administrative access to match that of a typical network appliance and not a multi-user UNIX device.For more details, see the Appendix for a link to “K12815: Overview of Appliance mode”.How Does That Affect Overall Severity of CVE-2021-23031?Combining the facts that the vulnerability allows an authenticated attacker to take complete control of the system, the CVSS score is 9.9 when the affected products are running in Appliance mode. Since Appliance mode is designed especially for sensitive sectors, the actual severity could be even higher.What Products Are Vulnerable to CVE-2021-23031?BIG-IP Advanced Web Application Firewall (WAF) and Application Security Manager (ASM) are vulnerable to CVE-2021-23031.Which Versions of WAF and ASM Are Vulnerable to CVE-2021-23031?The following versions are listed as vulnerable per F5:16.0.0 – 16.0.115.1.0 – 15.1.214.1.0 – 14.1.413.1.0 – 13.1.312.1.0 – 12.1.511.6.1 – 11.6.5Is the Vulnerability Exploited in the Wild?At the time of this writing, FortiGuard Labs is not aware of the vulnerability being exploited in the wild.FortiGuard Labs will continue to monitor the situation and provide updates as they become available.Is There Any Mitigation for CVE-2021-23031?According to the advisory, “the only mitigation is to remove access (to the Configuration utility) for users who are not completely trusted”.Has the Vendor Released Patches for the Vulnerabilities in their August 2021 Advisory?Yes, the vendor has released patches for all vulnerabilities listed in the advisory, including CVE-2021-23031.What is the Status of Coverage?As this time of writing, there is not sufficient information and Proof-of-Concept code available for FortiGuard Labs to create protections.FortiGuard Labs will continue to monitor the situation and provide updates as they become available.

Read More

UPDATE 9/17 – An IPS signature has been released in definitions (18.160) as “MS.Exchange.Server.SecurityToken.Authentication.Bypass”FortiGuard Labs is aware of a new disclosure dubbed PROXYTOKEN, which is an authentication bypass in Microsoft Exchange server. The vulnerability was reported by security researcher Le Xuan Tuyen of the Zero Day Initiative (ZDI) in March 2021, and patched by Microsoft in the July 2021 release.Assigned CVE-2021-33766, this vulnerability allows an unauthenticated attacker to configure actions on mailboxes belonging to arbitrary users on the mail server. An example of this usage allows the threat actor to forward all emails addressed to an arbitrary user and forward them to an attacker controlled account.What are the Technical Details of this Vulnerability?Microsoft Exchange server creates two reference sites in IIS, one listening on port 80 HTTP and the other port 443 HTTPS. These pages are known as the Exchange Front End, and the Exchange Back End runs on port 81 HTTP and port 444 for HTTPS respectively. The front end is essentially a proxy to the back end. When forms require authentication, pages are served via /owa/auth/logon/aspx. Essentially, the issue lies when an Exchange specific feature called “Delegated Authentication” is deployed, the front end is unable to perform authentication on its own and passes each request directly to the back end and ultimately relies on the back end to determine if the incoming request is properly authenticated.Is there a Patch Available?Yes. Microsoft has released patches for this in the July 2021 release.What is the Status of Coverage?Customers running the latest definitions are protected by the following IPS signature:MS.Exchange.Server.SecurityToken.Authentication.BypassWhat Products are Affected?Microsoft Exchange Server 2019, 2016, 2013 are affected.Any Other Suggested Mitigation?Disconnect vulnerable Exchange servers from the internet until a patch can be applied.Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.

Read More