Week in review: Log4j new vulnerabilities, Microsoft patch bypass, 2022 e-commerce threat trends
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) | |
| CVE-2021-44228 | JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell) Apache Log4j2, an extremely widely used Java logging library, fails to protect its JNDI lookup feature against attacker-controlled JNDI-related endpoints (CWE-20, CWE-502), so crafted text processed by the logger causes the Java runtime to fetch and load attacker-supplied objects, leading to remote code execution. The flaw is triggered whenever attacker-controlled input reaches the logging API and is parsed for JNDI lookups, a pattern common in web servers and enterprise Java applications that log user-supplied fields such as headers or form values. Successful exploitation yields arbitrary code execution under the privileges of the affected application, giving attackers a foothold for lateral movement, data theft, and ransomware deployment. Any Java application or product that ships or bundles an affected Apache Log4j2 release is exposed, making this one of the most broadly deployed vulnerabilities ever disclosed. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-10 with known ransomware use, and EPSS assigns a 100% probability of exploitation within 30 days. Do: Inventory all Java applications and dependencies for Apache Log4j2 and apply the vendor's patched updates, or remove affected assets from the network, as required by CISA's KEV catalog. Where updates are not yet available, use the temporary mitigations in CISA's ED-22-02 recommended-mitigation guidance, such as disabling message lookups, only until patches are applied. Prioritize internet-facing and business-critical systems and hunt for exploitation activity given known ransomware use. | 10.0 | 100% | KEV ransomware PoC ×9 |
| masshundreds of millions of Java applications/devices, with hundreds of thousands of internet-exposed services |
Full article912 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, articles and interviews:
The Log4j saga: New vulnerabilities and attack vectors discovered
The Apache Log4j saga continues, as several new vulnerabilities have been discovered in the popular library since Log4Shell (CVE-2021-44228) was fixed by releasing Log4j v2.15.0.
Log4Shell is a dumpster fire that should have been avoided
If basic IT hygiene guidance had been followed, Log4j would have easily been immune to this type of vulnerability, but the internet has not exactly been built by way of hygiene.
Combating identity fraud: The key is to avoid stagnation
In this interview with Help Net Security, Tom Wesselman, CTO of TeleSign, explains how to successfully combat identity fraud to not only protect an organization but its customers too.
The cybersecurity executive order is not all it’s cracked up to be
Seventy-two percent of federal cybersecurity leaders say the White House’s May 2021 Cybersecurity Executive Order (EO) addresses only a fraction of today’s cybersecurity challenges, according to a study from MeriTalk.
Cyber insurance trends: Insurers and insurees must adapt equally to growing threats
In this interview with Help Net Security, Avi Bashan, CTO at Kovrr, talks about cyber insurance trends and how the growing threat landscape impacted both insurers and insurees.
Shifting security further left: DevSecOps becoming SecDevOps
Veracode has revealed usage data that demonstrates cybersecurity is becoming more automated and componentized in line with modern software architectures and development practices.
CTO of Security at Salesforce talks e-commerce cybersecurity threat trends for 2022
In this interview with Help Net Security, Dr. Taher Elgamal, cryptographer, infosec leader and currently the CTO of Security at Salesforce, talks about the obstacles retailers’ need to overcome to increase their cybersecurity posture and his expectations for the threat landscape in 2022.
How likely are employees to fall prey to a phishing attack?
22% of employees are likely to expose their organization to the risk of cyber attack via a successful phishing attempt, a Phished report reveals.
Zero trust isn’t just for IT, it can also protect targeted critical infrastructure
Bare-minimum OT security is no longer passable in today’s cyber landscape. A future-proof solution is already effective in the IT world: zero trust. Let’s examine some of the big challenges in OT security, and how zero trust can fix them.
Cybersecurity budgets surge, as skills gap wreaks havoc on 2022 plans
As enterprises plan and set budgets for the new year ahead, the vast majority are expecting to channel more dollars toward enhancing their cybersecurity efforts.
How can AI be made more secure and trustworthy?
While we’re still debating whether and how long it will take to reach singularity and superintelligence, artificial intelligence is playing an increasingly important role in our everyday lives.
Attackers bypass Microsoft patch to deliver Formbook malware
Sophos Labs researchers have detected the use of a novel exploit able to bypass a patch for a critical vulnerability (CVE-2021-40444) affecting the Microsoft Office file format.
6 top cybersecurity trends from 2021 and their impact on 2022
2021 has been a wild year in the cybersecurity space. From supply chain attacks like the SolarWinds hack to the NSO Group’s spyware scandal to the Colonial Pipeline ransomware attack, organizations are facing new (and repackaged) attacks daily. In fact, according to the Identify Theft Resource Center, the total number of data breaches through September 2021 has already exceeded 2020 numbers by 17%.
PCI SSC updates its device security standard for HSMs
The PCI SSC published the latest version of its device security standard for Hardware Security Modules (HSMs). HSMs are secure cryptographic devices that are used for cryptographic-key management and the protection of sensitive data used in payment card processing.
Open-source software holds the key to solving Log4Shell-like problems
Earlier this month, the existence of a critical vulnerability in Apache Log4j 2 was revealed and a PoC for it published. Dubbed Log4Shell, it’s an issue in a logging library for Java applications that is widely used across popular open-source projects and enterprise-grade back-end applications. Log4Shell introduced a critical security risk, scoring 10 out of 10 in severity.
Ransomware Empire: Who might blackmail your company?
The history of ransomware attacks covers slightly over 30 years. Over this modest period, cybercriminals have been relentlessly building ransomware capacities and improving logistics to facilitate the infections of their victims and reach the most high-profile targets. This helped ransomware operators climb to the top of the cybercriminal hierarchy and earn the name of the number one cyber threat.
Five cybersecurity predictions for 2022 and beyond
2021 saw some of the largest and most influential cyber attacks to date. Leaders in cybersecurity have faced numerous challenges this year and are likely to experience unprecedented obstacles in the years to come.
GoTestWAF: Open-source project for evaluating web application security solutions
GoTestWAF is a tool for API and OWASP attack simulation that supports a wide range of API protocols including REST, GraphQL, gRPC, WebSockets, SOAP, XMLRPC, etc. It was designed to evaluate web application security solutions, such as API security proxies, web application firewalls, IPS, API gateways, and others.
Why the updated OWASP Top 10 list can’t be addressed by WAF?
Did you know that OWASP published its updated Top 10 web vulnerabilities list? And that it includes updates that could impact the design and functionality of your WAF solution?
New infosec products of the week: December 24, 2021
Here’s a look at the most interesting products from the past week, featuring releases from BlackBerry, Box, and Veriff.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/12/26/week-in-review-log4j-new-vulnerabilities-microsoft-patch-bypass-2022-e-commerce-threat-trends/