In this week's Security Advisory:
Fortinet has issued several security patches to address vulnerabilities detected in its products. Currently, there are five (5) vulnerabilities being tracked with two (2) as 'critical' and three (3) as 'high' in terms of severity.
CVE-2023-42789 (CVSS score: 9.8) is a critical out-of-bounds write flaw, while CVE-2023-42790 (CVSS score: 8.1) represents a buffer overflow vulnerability. When combined, these vulnerabilities can enable an attacker to execute arbitrary commands via specially crafted HTTP requests within the FortiOS and FortiProxy environments.
CVE-2023-48788 (CVSS score: 9.8) exposes a critical vulnerability within FortiClientEMS. This flaw can allow remote attackers to execute commands on an administrative host due to inadequate input validation. Consequently, threat actors can manipulate SQL queries to carry out unauthorized actions, such as generating unwanted log entries.
The following versions are affected:
More Reading/Information
Cisco has released a patch addressing two (2) high-severity vulnerabilities discovered in the Secure Client VPN application. CVE-2024-20337, rated with a CVSS score of 8.2 out of 10, involves a flaw in the SAML authentication process. This flaw enables remote threat actors to execute arbitrary script code within the browser by exploiting inadequate validation of user input. Additionally, adversaries can exploit this vulnerability to pilfer the SAML token, subsequently establishing a remote access VPN session with the privileges of the targeted user. CVE-2024-20338, rated with a CVSS score of 7.3 out of 10, is a vulnerability within Secure Client for Linux. This flaw enables a threat actor with local access to the host to execute arbitrary code with root privileges. The exploit involves placing a malicious library script file within a system directory in the file system and initiating a process restart by an administrator.
Affected Versions:
More Reading/Information
In the March 2024 patch Tuesday release, Microsoft tackled a total of sixty (60) vulnerabilities, two (2) of which were classified as 'critical.' Notably, both critical vulnerabilities are related to Windows HyperV. One of them, CVE-2024-21407 (CVSS score 8.1), poses a risk of remote code execution, enabling authenticated threat actors on a virtual machine to execute malicious code by sending a specifically crafted file. The other, CVE-2024-21408 (CVSS score 5.5), involves an issue within the virtual machine that could potentially result in denial of service attacks.
More Reading/Information
QNAP released updates to fix three (3) critical vulnerabilities affecting several QNAP operating system versions and applications on its NAS devices, including QTS, QuTS hero, QuTScloud, and myQNAPcloud.
The most severe of these is CVE-2024-21899, which has a CVSS score of 9.8 out of 10, enabling a threat actor to remotely compromise system security without authentication.
The other vulnerabilities, CVE-2024-21900 and CVE-2024-21901, possess lower CVSS scores of 4.3 and 4.7 respectively, as they require an authenticated user for exploitation. CVE-2024-21900 permits an authenticated attacker to inject arbitrary commands into a system via a network, while CVE-2024-21901 is a SQL injection vulnerability allowing a threat actor to deploy malicious code and compromising database integrity.
Affected versions:
More Reading/Information
AnyCubic has issued an update to the Kobra 2 firmware addressing a recently discovered zero-day vulnerability impacting 3D printers. Security researchers demonstrated a proof of concept revealing the potential for threat actors to gain control over the printer via the cloud's MQTT server using any valid credential. Although an official CVSS score for the vulnerability is pending, AnyCubic has implemented several measures to mitigate the issue, including strengthening security verifications for file downloads and enhancing security protocols for MQTT server connections.
More Reading/Information
There were security updates released by Adobe and Google Chrome Desktop Browser to address several vulnerabilities in each product.
Adobe had over fifty-eight (58) vulnerabilities, with eight (8) vulnerabilities given a severity rating of 'critical'. These vulnerabilities affect Adobe Experience Manager, Premiere Pro, ColdFusion, Bridge, Lightroom, and Animate.
Google released a security update to fix three (3) vulnerabilities in its Chrome Desktop Browser for Windows, Mac, and Linux. CVE-2024-2400 is being tracked as a high-severity flaw that allows a threat actor to create a custom made HTML page and cause the browser to crash through heap corruption. This can be accomplished by freeing the memory allocation of a program but not clearing the pointer to the memory resulting in an error.
More Reading/Information
Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to "vendor-supported versions" only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, Cybersafe strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.