In this week's Security Advisory:
Broadcom has patched a critical security issue in its VMware vCenter Server. The vulnerability tracked as CVE-2024-38812 (CVSS score 9.8/10), allows unauthenticated attackers to execute remote code on the server if exploited. They also released a patch for a high-severity privilege escalation vulnerability, tracked as CVE-2024-38813 (CVSS score 7.5/10), that allows an attacker to gain root privileges. Broadcom stated they have not seen evidence of this being exploited in the wild.
Affected Versions
More Reading/Information
SolarWinds has released security updates to remediate two (2) vulnerabilities in its Access Rights Manager (ARM) software. The most concerning of the two is vulnerability CVE-2024-28991 (CVSS score 9.9/10) which is susceptible to remote code execution. Authentication is required to exploit this vulnerability; however, it is possible to bypass authentication due to the vulnerability CVE-2024-28990.
Affected Versions
More Reading/Information
Ivanti issued a warning that a recently patched vulnerability for its Cloud Service Appliance, tracked as CVE-2024-8190 (CVSS score 7.2/10), is now being exploited in the wild. Organizations should patch immediately.
Original Advisory September 11th:
Ivanti has released security updates for its Endpoint Manager (EPM), addressing a critical vulnerability that could lead to unauthorized access to the EPM core server, Ivanti also released updates for other critical and high vulnerabilities today in their Workspace Control (IWC) and Cloud Service Appliance (CSA).
Affected Versions
More Reading/Information
GitLab released security updates for seventeen (17) vulnerabilities including one critical vulnerability tracked as CVE-2024-6678 (CVSS 9.9/10). The Critical vulnerability allows for remote executions with arbitrary user permissions. This affects GitLab's Community Edition (CE) and Enterprise Edition (EE). It is recommended that you apply the latest patches as soon as possible to mitigate the risk of this threat.
Affected Versions
More Reading/Information
Palo Alto has released security updates for multiple products in their most recent Security Bulletin. The most concerning is a flaw tracked as CVE-2024-8686 (CVSS 8.6/10). If exploited, this may allow an unauthenticated attacker to execute commands as root on the device.
Palo Alto also addressed twenty-nine (29) vulnerabilities for its Prime Access Browser. Most of these vulnerabilities are being tracked with a High severity rating. Multiple Medium-severity vulnerabilities were addressed in the bulletin as well.
Affected Versions
More Reading/Information
D-Link has released security updates to multiple wireless router models. This includes three (3) critical and two (2) high CVEs. Two of the critical vulnerabilities allow unauthenticated attackers to execute arbitrary code on the devices. The third critical vulnerability allows remote attackers to log in and execute commands with hard-coded credentials.
Affected Versions
More Reading/Information
Thirty-two (32) vulnerabilities have been identified in Apple products, with the most severe potentially allowing arbitrary code execution. Successful exploitation of these critical vulnerabilities could enable arbitrary code execution within the context of the logged-in user. This includes CVE-2024-44171 (CVSS score 8.1/10) where an attacker with physical access to a locked device may be able to control nearby devices via accessibility features.
Affected Versions
More Reading/Information
Google released a security update to fix nine (9) vulnerabilities in its Chrome Desktop Browser for Windows, Mac, and Linux. This includes CVE-2024-8904 a bug in the V8 JavaScript engine that can lead to remote code execution.
Affected Versions
More Reading/Information
Please review your environment to ensure the above-mentioned issues are patched in a timely manner. It is security best practice to regularly update and/or patch software to the latest versions. The vulnerabilities above highlight the security benefits of limiting deployed software to "vendor-supported versions" only. This dramatically increases the likelihood that new vulnerabilities have a patch issued for them. Likewise, Cybersafe strongly encourages maintaining an inventory of current software in your environment, which helps ensure and inform your patch and vulnerability management program.