In this week's Security Advisory:
Apple released security updates to address vulnerabilities in several of its products, including two (2) actively exploited zero-days affecting older devices. The zero-days (CVE-2023-42916 and CVE-2023-42917) were disclosed at the beginning of December and could lead to the disclosure of sensitive information or arbitrary code execution when processing specially crafted web content. There are reports of these vulnerabilities actively being exploited against versions of iOS before iOS 16.7.1.
The following versions are affected:
More Reading/Information:
Threat actors are actively exploiting a critical vulnerability (CVE-2023-26360) in unpatched Adobe ColdFusion servers. CVE-2023-26360 was previously disclosed in March 2023 and has an existing patch. It is recommended to apply the patch to affected systems immediately if you have not already done so.
Original Security Advisory - March 13th, 2023:
Adobe released patches for several of its products, including a critical vulnerability in Adobe ColdFusion. The vulnerability is being tracked as CVE-2023-26360 and could lead to arbitrary code execution, giving an attacker the ability to view, change or delete information on the affected system. CVE-2023-26360 has been given a CVSS score of 8.6 out of a possible 10 and is actively being exploited in the wild. Along with this vulnerability, there were a total of one hundred and six (106) vulnerabilities, and sixty-one (61) vulnerabilities receiving a severity rating of "critical".
The following products are affected:
Adobe has released updated versions of all products above and should be applied immediately. The security updates can be found at the following link: https://helpx.adobe.com/security.html
More Reading/Information:
New threat intel indicates that threat actors are actively exploiting a critical vulnerability (CVE-2022-32360) in older, unsupported versions of Sophos Firewall. CVE-2022-32360 was previously disclosed in September 2022 and has an existing patch. However, to mitigate this threat against older, unsupported versions of Sophos Firewall, Sophos has released patches for devices running end-of-life firmware. By default, automatic updates are enabled in Sophos Firewall, so there is no further action required for customers. However, if this setting is disabled, users are required to upgrade their end-of-life devices and firmware to the latest version.
Original Security Advisory - September 28th, 2022:
Sophos released a patch for a code injection vulnerability found in the User Portal and Webadmin components of the Firewall that could allow for remote code execution. This critical vulnerability (CVE-2022-3236) affects Sophos Firewall v19.0 MR1 (19.0.1) and older and has been given a CVSS score of 9.8 out of a possible 10. If successfully exploited, an attacker can install programs, view, change, or delete information, and potentially gain control of the affected system.
By default, automatic updates are enabled in Sophos Firewall, so there is no further action required for customers. However, if this setting is disabled, users are required to upgrade to the latest version to receive this patch.
More Reading/Information:
WordPress disclosed a critical vulnerability in the plugin, Backup Migration, which could lead to remote code execution. The WordPress plugin has over 90,000 active installations and is vulnerable to CVE-2023-6553, a PHP code injection vulnerability. This vulnerability allows an unauthenticated attacker to execute remote code and potentially gain control over the vulnerable website. CVE-2023-6553 received a CVSS score of 9.8 out of a possible 10.
This vulnerability affects the following versions:
More Reading/Information:
There were security updates released for Microsoft, Google Chrome desktop browser, and Adobe products. The most severe could lead to arbitrary code execution. There are no reports of any of these vulnerabilities being exploited in the wild.
Microsoft addressed a total of thirty-four (34) vulnerabilities in its December 2023 Patch Tuesday release. Of the vulnerabilities disclosed, there were four (4) vulnerabilities that received a severity rating of "Critical". This release did not contain any vulnerabilities that have been actively exploited in the wild.
Google Chrome had a total of nine (9) vulnerabilities, with five (5) vulnerabilities given a severity rating of "High". These vulnerabilities affect Windows, Mac, and Linux. At this time, only a patch for Mac and Linux has been released while a patch for Windows is expected to be released shortly.
Adobe had over two hundred (200) vulnerabilities, with thirteen (13) vulnerabilities given a severity rating of "Critical". These vulnerabilities affect Adobe Prelude, Illustrator, InDesign, Dimension, Experience Manager, Substance3D Stager, Substance3D Sampler, Substance3D After Effects, and Substance3D Designer.
More Reading/Information:
Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to "vendor-supported versions" only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, Cybersafe strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.