Week in review: New Intel CPU vulnerabilities, SharePoint servers under attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-0604 | RCE in Microsoft SharePoint via Application Package Markup Validation Flaw Microsoft SharePoint fails to check the source markup of an application package, an improper input validation flaw (CWE-20) that allows maliciously crafted markup to be processed by the server. An attacker triggers the flaw by getting an affected SharePoint server to handle a crafted application package, without any special privileges described in the disclosure. Successful exploitation lets the attacker run remote code in the context of the SharePoint application pool and the SharePoint server farm account, providing control of the web server and access to a highly privileged farm-level identity. Any organization running an affected on-premises Microsoft SharePoint deployment is exposed, with internet-facing SharePoint servers at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and EPSS puts the probability of exploitation at 99.9%, although no public proof-of-concept is catalogued. Do: Apply Microsoft's SharePoint security updates per vendor instructions immediately, prioritizing internet-exposed SharePoint servers as CISA's required action directs. Given known in-the-wild and ransomware use, hunt for signs of compromise such as unexpected .aspx or webshell files in SharePoint directories and anomalous use of the SharePoint farm account. Restrict or firewall internet exposure of SharePoint servers until patches are confirmed applied. | 9.8 | 100% | KEV ransomware |
| mass≈ hundreds of thousands of on-prem SharePoint server deployments worldwide, of which tens of thousands are directly internet-facing (estimate) | |
| CVE-2019-0708 | Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep) CVE-2019-0708 is a use-after-free (CWE-416) vulnerability in Microsoft Remote Desktop Services, formerly Terminal Services, in which an unauthenticated attacker can connect to a target system over RDP and send specially crafted requests to trigger the flaw. Because the trigger requires no authentication, the flaw is wormable: a successful exploit grants remote code execution on the target host, potentially with elevated privileges, and could allow self-propagating attacks similar to WannaCry. Organizations running the affected Microsoft Remote Desktop Services, particularly legacy Windows releases still accepting inbound RDP connections, are in scope. Exploitation is confirmed in the wild: the flaw (nicknamed BlueKeep) is listed in CISA's KEV catalog (added 2021-11-03), CISA notes known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days. Do: Apply Microsoft's security updates for CVE-2019-0708 per vendor instructions, prioritizing legacy or end-of-support Windows systems exposed to inbound RDP. As mitigation, restrict RDP (TCP 3389) to trusted networks or VPN access, require Network Level Authentication (NLA), and audit perimeter firewalls and public scans for open RDP listeners. The vulnerability is in the CISA KEV catalog, so patching is treated as a required action for federal and high-risk environments. | 9.8 | 100% | KEV ransomware PoC ×4 |
| masson the order of millions of internet-exposed RDP endpoints and far more internal systems |
Full article993 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news and articles:
High-risk vulnerability in Cisco’s secure boot process impacts millions of devices
Red Balloon Security has discovered a high-risk vulnerability in Cisco’s secure boot process which impacts a wide range of Cisco products in use among enterprise and government networks, including routers, switches and firewalls.
Tips to spring clean your company’s social media and stay protected
Spring is a great time for organizations and businesses to examine or re-evaluate the security posture of their social media presence and related activities.
Identity theft victims could lead us to accept more security-improving friction
Far too many individuals who have never been victims of identity theft and financial crimes don’t understand how devastating those are to victims.
Intel MDS attack mitigation: An overview
Intel has revealed that some of its CPUs are vulnerable to a number of new speculative execution attacks that may allow attackers to stealing sensitive data and keys/passwords.
Microsoft plugs wormable RDP flaw, new speculative execution side channel vulnerabilities
Microsoft has released fixes for 79 vulnerabilities, 22 of which are deemed critical. Among the fixes is that for CVE-2019-0708, a “wormable” RDP flaw that is expected to be weaponised by attackers very soon.
Despite warnings, most people still don’t change their passwords
64% of people use the same password for some, or even all, of their online accounts, while only 21% use a different password for each account.
The lurking danger of hacked email reply chains
Although phishing has been around in various forms since the 1990s, recent news has shown that it continues to evolve – and remains a major threat. These days, phishing tactics are so sophisticated it can be difficult to spot a scam – particularly in the case of hijacked email reply chains.
What does it take to be an infosec product strategist?
Choosing a security product that will best fit your organization’s needs is a challenge exacerbated by the “polluted, turbulent sea of ineffectual security products” that you’ll need to wade through in order to find the right and effective solution.
PII capturing websites still applying poor security measures one year after GDPR
One year after the EU General Data Protection Regulation (GDPR) went into effect, 1 in 10 PII capturing websites belonging to the top 10 UK financial services organizations are still doing so without adequate security measures, potentially breaching GDPR guidelines, RiskIQ has discovered.
How can we give cybersecurity analysts a helping hand?
It’s tough being a cybersecurity analyst these days. Over the last few years we have been repeatedly reminded of the challenge they are now facing, primarily through the steady stream of high-profile data breaches that have hit the headlines.
What CISOs should focus on when deciding on a strategy
The effectiveness of an organization’s security strategy and implementation can sometimes be difficult to assess. Michael Hamilton, President and CISO of CI Security, says looking at a number of key performance indicators can help.
WhatsApp flaw used to install spyware by simply calling the target
A security vulnerability in the popular Facebook-owned end-to-end encrypted messaging app WhatsApp allowed attackers to install spyware on smartphones without any user interaction, Financial Times has reported.
CISOs: What would you do over?
The first theme CISOs talked about was regretting they hadn’t built a strategic plan for their new security programs early on. They noted that they could have saved themselves a lot of extra work and gone a lot faster if they had spent the time to flesh out a roadmap.
SharePoint servers under attack through CVE-2019-0604
CVE-2019-0604, a critical vulnerability opening unpatched Microsoft SharePoint servers to attack, is being exploited by attackers to install a web shell.
Security spring cleaning: 5 tips for tidying up network safeguards
Networks need regular cleaning just like your home, car or garage. Why? The answer is simple – poor security hygiene can lead to major data breaches. If you don’t regularly review your network, potential weaknesses and vulnerabilities will stack up.
Half of companies missed GDPR deadline, 70% admit systems won’t scale
Even if given two years notice to achieve GDPR compliance, only half of companies self-reported as compliant by May 25, 2018, a DataGrail survey reveals.
Google offers free replacement for buggy Titan Security Keys
Misconfigured Bluetooth pairing protocols in Google’s Titan Security Keys may allow attackers to communicate with users’ security key or with the device their key is paired with, Google has warned.
Cybersecurity skills shortage still the root cause of rising security incidents
The cybersecurity skills shortage is worsening for the third year in a row and has impacted nearly three quarters (74 percent) of organizations, as revealed in the third annual global study of cybersecurity professionals by the Information Systems Security Association (ISSA) and independent industry analyst firm Enterprise Strategy Group (ESG).
Memory analysis is the ground truth
While the majority of endpoint protection solutions are focused on identifying the symptoms or behaviors of a machine to detect suspicious activity — for example, abnormal network connections or data leakage — the real threat lies in the malicious code that is running in memory.
Organizations dissatisfied with WAFs ineffective protection, time-consuming management, high cost
Only 40% of organizations are satisfied with their web application firewall (WAF), according to the Ponemon Institute report released by Cequence Security.
The six biggest cybersecurity risks facing the utilities industry
The utilities industry is rapidly modernizing its infrastructure, adding more digitized equipment and connectivity across devices, plants, and systems. This evolution to “smart infrastructure” represents a positive, paradigm shift for the industry.
When all else fails, organizations realize they must share threat intel
A large majority of security IT decision makers are ready and willing to share valuable threat intelligence data to help the collective industry make better, more informed decisions when it comes to cyber attacks, an IronNet Cybersecurity report reveals.
New infosec products of the week: May 17, 2019
A rundown of infosec products released last week.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/05/19/week-in-review-new-intel-cpu-vulnerabilities-sharepoint-servers-under-attack/