Week in review: Microsoft patches zero-day, Apple security updates, HashiCorp Vault vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-0620 | HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9. NVD description · AI analysis pending | 6.7 | <1% |
| — | ||
| CVE-2023-28205 | Use-After-Free in Apple WebKit (iOS, iPadOS, macOS, Safari) Enables Code Execution CVE-2023-28205 is a use-after-free flaw (CWE-416) in the WebKit engine shipped with Apple iOS, iPadOS, macOS, and the Safari browser, where memory is freed and then incorrectly reused while processing HTML. It is triggered when a device processes maliciously crafted web content, meaning simply loading an attacker-controlled page in Safari or any WebKit-based HTML renderer can trigger the bug. Successful exploitation allows the attacker to achieve code execution in the context of the WebKit process on the victim device. All users of iOS, iPadOS, macOS, and Safari are potentially affected, as are non-Apple products that rely on WebKit for HTML processing. The flaw is being actively exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2023-04-10, with the required action to apply updates per vendor instructions — and EPSS assigns a 27.1% probability of exploitation within 30 days (98th percentile). Do: Apply Apple's current security updates for iOS, iPadOS, macOS, and Safari as soon as possible, per the vendor instructions cited in the CISA KEV listing. Because this is a browser/HTML-engine flaw exploited in the wild, prioritize patching internet-facing and high-risk user fleets; users of non-Apple WebKit-based HTML parsers should check with their software vendors for updated WebKit components. Until patched, exercise caution with untrusted web content. | 8.8 | 27% | KEV |
| mass≈ hundreds of millions of devices (WebKit is the HTML engine in every iOS, iPadOS, and macOS install and in Safari) | |
| CVE-2023-28206 | Out-of-Bounds Write in Apple IOSurfaceAccelerator Allows Kernel-Level Code Execution Apple's IOSurfaceAccelerator component in iOS, iPadOS, and macOS contains an out-of-bounds write flaw (CWE-787). The bug is triggered by an application running locally on the device, which can corrupt memory in the component during a write past a buffer boundary. A successful exploit allows the app to execute arbitrary code with kernel privileges, giving it full control of the device beyond the normal app sandbox. Any user of an Apple iOS, iPadOS, or macOS device running an affected, unpatched version is exposed. The flaw was added to CISA KEV on 2023-04-10, confirming known in-the-wild exploitation; ransomware use is unknown, no public PoC is available, and EPSS assigns a 24.5% probability of exploitation within 30 days (98th percentile). Do: Update all iPhones, iPads, and Macs to the latest iOS/iPadOS/macOS versions available as of April 2023, per CISA's required action and Apple's security advisories. Use MDM or patch-reporting tooling to inventory endpoints and confirm no devices remain on pre-patch builds. Because exploitation is confirmed in the wild and any local app can act as the trigger, patching is the primary mitigation and there is no dependable configuration workaround. | 8.6 | 23% | KEV |
| masshundreds of millions of devices (Apple's active iPhone/iPad/Mac installed base exceeds 1 billion) | |
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation CVE-2023-28252 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Common Log File System (CLFS) driver that allows privilege escalation. The flaw is triggered when the kernel's CLFS driver processes malformed or maliciously crafted log file data, corrupting heap memory; an attacker who can already run code on a target system (e.g., a low-privileged user or an attacker chained with another flaw such as a remote code execution bug) can leverage it to gain SYSTEM-level privileges. Because the CLFS driver ships with supported Windows client and server releases, essentially the entire Windows installed base is potentially exposed. The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2023-04-11 with known ransomware use, and EPSS estimates a 49.0% probability of exploitation within 30 days (99th percentile). It was addressed in Microsoft's April 2023 security updates, and the required remediation action is to apply the vendor updates. Do: Apply Microsoft's April 2023 (or later) cumulative security updates to all Windows clients and servers per vendor instructions, prioritizing high-value and domain infrastructure systems given the known ransomware use; there is no public PoC or known workaround, so patching is the primary mitigation. Note that this is a local elevation-of-privilege flaw, so also hunt for prior low-privilege access or exploitation chains on hosts, and confirm remediation by checking installed update levels across the estate. | 7.8 | 49% | KEV ransomware PoC |
| masshundreds of millions of Windows devices (the CLFS driver is present across essentially all modern Windows 10/11 and Windows Server installations) |
Full article1,030 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:
Making risk-based decisions in a rapidly changing cyber climate
In this Help Net Security interview, Nicole reveals the three key indicators she uses to assess an industrial organization’s cybersecurity readiness and provides valuable insights for businesses and governments on fortifying their critical infrastructure against cyber threats.
Data-backed insights for future-proof cybersecurity strategies
In this Help Net Security interview, Travis Smith, VP of the Qualys TRU, talks about the 2023 Qualys TruRisk Threat Research Report, which provides security teams with data-backed insights to help them better understand how adversaries exploit vulnerabilities and render attacks.
Google delivers secure open source software packages
Google has announced the Google Cloud Assured Open Source Software (Assured OSS) service, which aims to be a trusted source of secure open source packages, and the deps.dev API, which provides access to security metadata for 50+ million open source package versions.
3CX compromise: More details about the breach, new PWA app released
3CX has released an interim report about Mandiant’s findings related to the compromise the company suffered last month, which resulted in a supply chain attack targeting cryptocurrency companies.
Microsoft patches zero-day exploited by attackers (CVE-2023-28252)
It’s April 2023 Patch Tuesday, and Microsoft has released fixes for 97 CVE-numbered vulnerabilities, including one actively exploited zero-day (CVE-2023-28252).
Apple rushes fixes for exploited zero-days in iPhones and Macs (CVE-2023-28205, CVE-2023-28206)
Apple has pushed out security updates that fix two actively exploited zero-day vulnerabilities (CVE-2023-28205, CVE-2023-28206) in macOS, iOS and iPadOS.
Zelle users targeted with social engineering tricks
Cybercriminals have been leveraging social engineering techniques to impersonate the popular US-based digital payments network Zelle and steal money from unsuspecting victims, according to Avanan.
LinkedIn now allows you to verify your workplace
To combat the surge of fake LinkedIn accounts in recent years, Microsoft has introduced Entra Verified ID, a new feature that allows users to verify their workplace on the business-focused social media platform.
Kodi forum breach: User data, encrypted passwords grabbed
The developers of Kodi, the widely used open-source media player app, have revealed a data breach of its user forum.
Beware of companies offering paid sextortion assistance
Sextortion victims are already in a vulnerable position, and shady companies are taking advantage of this vulnerability to offer “sextortion assistance” services for huge sums – services that they may be unable to render or that won’t help the victims in any way.
Why it’s time to move towards a passwordless future
Adversaries don’t need to use sophisticated methods to gain access to enterprise systems or to deploy ransomware – they can just buy or steal credentials and log in.
Cybercriminals use simple trick to obtain personal data
People reveal more personal information when you ask them the same questions a second time – according to new research from the University of East Anglia.
How to transform cybersecurity learning and make content more engaging
In this Help Net Security video, Dr Jason Nurse, Director of Science and Research at CybSafe, and Associate Professor at The University of Kent, discusses how delivering cybersecurity content can be more engaging.
5 steps to building NSA-level access control for your app
Access control has become a main concern when it comes to developing secure web applications, and the NSA has a lot to say about it. Especially when it comes to the biggest access management pitfall developers make.
HashiCorp Vault vulnerability could lead to RCE, patch today! (CVE-2023-0620)
Oxeye discovered a new vulnerability (CVE-2023-0620) in the HashiCorp Vault Project, an identity-based secrets and encryption management system that controls access to API encryption keys, passwords, and certificates.
Key factors driving changes in the perception of the CISO role
In this Help Net Security video, Michael Scott, CISO at Immuta, talks about the internal and external factors driving the changes in workload and perception of the CISO role, including the evolving relationship of the CISO and C-suite, and how to power the use of data rather than restrict it.
The new weakest link in the cybersecurity chain
Organizations frequently run Internet-facing IT systems with years-old software that hasn’t been patched and that are not integrated into any security monitoring framework.
Hybrid work environments are stressing CISOs
The impact of the hybrid workforce on security posture, as well as the risks introduced by this way of working, are posing concerns for CISOs and driving them to develop new strategies for hybrid work security, according to Red Access.
Tactics that make crypto giveaway scams so successful
In this Help Net Security video, Tony Lauro, Director of Security Technology and Strategy at Akamai, discusses why crypto giveaway scams are so successful.
DDoS alert traffic reaches record-breaking level of 436 petabits in one day
With over one billion websites worldwide, HTTP/HTTPS application-layer attacks have increased by 487% since 2019, with the most significant surge in the second half of 2022, according to NETSCOUT.
Threat hunting programs can save organizations from costly security breaches
To better understand the perspective of threat hunters who are in the trenches defending their organizations every day, Team Cymru surveyed 218 experienced security analysts to learn what works and what doesn’t in their threat hunting program, how they measure success, and the biggest challenges they face.
Consumers take data control into their own hands amid rising privacy concerns
Data Subject Requests (DSRs), which are formal requests made by individuals to access, modify, or delete their personal data held by a company, increased by 72% from 2021 to 2022. The increase was primarily driven by deletion and access requests, according to DataGrail.
MSPs urged to refine security solutions in response to growing SMB needs
MSPs are focusing on automation and integration between their core tools to improve efficiency, service delivery and cost management, according to Kaseya.
Criminal businesses adopt corporate behavior as they grow
As criminal groups increase in size, they adopt corporate-like behavior, but this shift brings about its own set of challenges and costs, according to Trend Micro.
New infosec products of the week: April 14, 2023
Here’s a look at the most interesting products from the past week, featuring releases from BigID, Binarly, Cynalytica, GitGuardian, Netskope, Searchlight Cyber, ThreatX, and Wazuh.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/04/16/week-in-review-microsoft-patches-zero-day-apple-security-updates-hashicorp-vault-vulnerability/