Three More Vulnerabilities Found in SolarWinds Products
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-25274 +1 in the same advisory: …25275 | The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its private queues. As a result, remote unauthenticated clients can send messages to TCP port 1801 that the Collector Service will process. Additionally, upon processing of such messages, the service deserializes them in insecure manner, allowing remote arbitrary code execution as LocalSystem. NVD description · AI analysis pending | 9.8 group max | 36% | PoC |
| — |
Full article318 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have discovered three more vulnerabilities in SolarWinds products, including a critical remote code execution bug.
The IT management software provider has been in the news regularly over recent weeks after its Orion product was targeted by alleged Russian state hackers, in a major supply chain attack aimed at the US government.
A vulnerability patched in December was at the center of a new report this week claiming that Chinese state-sponsored threat actors exploited it as part of a cyber-espionage attack on a US federal payroll agency.
Now Trustwave is urging customers to address three “severe” flaws it found in SolarWinds products. The vendor fixed the issues promptly and there have been no reports of “in the wild” exploitation, but prompt patching is recommended.
Two of the software flaws are found in the SolarWinds Orion User Device Tracker and one is in the firm’s Serv-U FTP product.
The most critical vulnerability, CVE-2021-25274, is found in the former. It relates to the legacy Microsoft Message Queue (MSMQ) technology which is set up on installation, and could allow any remote unprivileged user to execute any arbitrary code with the highest privileges.
The second bug, CVE-2021-25275, affects the same product. Trustwave claimed that SolarWinds credentials are stored in an insecure manner which could allow local users to take complete control over the SOLARWINDS_ORION database. In so doing, they could steal data or add a new admin-level user inside SolarWinds Orion products, it said.
Finally, there’s CVE-2021-2527, in the SolarWinds Serv-U FTP for Windows product.
“Any local user, regardless of privilege, can create a file that can define a new Serv-U FTP admin account with full access to the C:\ drive. This account can then be used to login via FTP and read or replace any file on the drive,” explained Trustwave.
The security vendor said it is giving customers an extra week to patch before it releases proof-of-concept code.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/three-more-vulnerabilities/