Week in review: Windows zero-day exploited, Patch Tuesday forecast, selecting a compliance solution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-15999 | Heap Buffer Overflow in FreeType Font Rendering in Google Chrome (CVE-2020-15999) Google Chrome bundles the open-source FreeType library for font rendering, and that library contains a heap buffer overflow (CWE-787, out-of-bounds write) in its Load_SBit_Png function. The flaw is triggered when the browser loads a crafted font containing a malicious PNG image embedded as embedded bitmap data, typically from a web page the victim visits, corrupting heap memory with attacker-controlled data. Successful exploitation can crash the browser or execute code in the renderer, and it was used in the wild as part of an exploit chain combined with CVE-2020-17087 (Windows kernel) and CVE-2020-16010 (Android) to escape the sandbox. Anyone running an affected Google Chrome release that ships the vulnerable FreeType code, across Windows, macOS, Linux, Chrome OS and Android, is affected, meaning effectively the entire Chrome install base at the time of disclosure. The vulnerability is confirmed exploited in the wild (listed in CISA's KEV catalog, added 2021-11-03; ransomware use unknown), Google patched it in Chrome 86.0.4240.111, no public proof-of-concept is known, and EPSS estimates a 44.3% probability of exploitation within 30 days (99th percentile). Do: Update Google Chrome to 86.0.4240.111 or later (any current stable-channel release satisfies this), and where other software bundles FreeType directly, update to FreeType 2.10.4 or later per the upstream fix. Because the bug was chained with CVE-2020-17087 on Windows and CVE-2020-16010 on Android, also apply the corresponding Microsoft Windows and Android updates to close the sandbox-escape chain. Use endpoint management to inventory browser versions and confirm no endpoints remain below the fixed release, as required by the CISA KEV catalog. | 9.6 | 44% | KEV PoC ×2 |
| masson the order of billions of users (Chrome's active user base exceeded ~3 billion at the time; the vulnerable FreeType code shipped in every affected release) | |
| CVE-2020-16009 | Type Confusion in Google Chromium V8 Engine Enables RCE via Crafted HTML Pages CVE-2020-16009 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chromium, which can lead to heap corruption (CWE-787). A remote attacker triggers it by getting a user to load a specially crafted HTML page, such as via a malicious or compromised website. Successful exploitation corrupts the heap and can potentially allow the attacker to execute code in the context of the affected browser. Any Chromium-based browser or application embedding V8 is affected, including Google Chrome, Microsoft Edge, and Opera, meaning the affected population is effectively the entire Chromium user base worldwide. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, with an EPSS probability of 48.3% (99th percentile); ransomware use is unknown and no public PoC is known. Do: Apply the vendor update per CISA's required action: update all Chromium-based browsers (Chrome, Edge, Opera, and derivatives) to the latest stable releases from each vendor and restart browsers afterward. Inventory any embedded or packaged Chromium/V8 runtimes in other applications and update them as their maintainers ship fixes. Given confirmed in-the-wild exploitation and high EPSS, prioritize patching endpoints used for web browsing by high-risk users first. | 8.8 | 48% | KEV PoC ×2 |
| mass≈3+ billion browser users/installations (Chromium is the world's dominant browser engine) | |
| CVE-2020-16010 | Heap Buffer Overflow in Google Chrome for Android Enables Sandbox Escape CVE-2020-16010 is a heap buffer overflow (out-of-bounds write, CWE-787/CWE-122) in the UI layer of Google Chrome on Android, fixed in version 86.0.4240.185. It is triggered by a crafted HTML page after a remote attacker has already compromised the Chrome renderer process, meaning it typically functions as a second-stage component of an exploit chain. Successful exploitation lets the attacker escape Chrome's sandbox, moving from the isolated renderer to broader access on the device, with confidentiality, integrity, and availability all rated high (CVSS 3.1: 9.6). Users running Chrome on Android prior to 86.0.4240.185 are affected. The flaw is confirmed exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 — and EPSS assigns a 6.4% probability of exploitation in the next 30 days (93rd percentile). Do: Update Chrome on Android to 86.0.4240.185 or later via Google Play and confirm the version on the device (chrome://version); given the CISA KEV listing, treat this patch as urgent. Because the bug requires a prior renderer compromise, also ensure the device's Chrome build includes all current renderer fixes, and enable Play Store auto-updates on managed fleets. | 9.6 | 6% | KEV |
| mass≈1–3 billion users (Chrome for Android has billions of installs and ships as the default browser on most Android devices) | |
| CVE-2020-17087 | Windows Kernel Buffer Overflow Enables Local Privilege Escalation (CVE-2020-17087) CVE-2020-17087 is a local elevation-of-privilege flaw in the Windows kernel caused by an incorrect buffer size calculation (CWE-131), producing a kernel buffer overflow; public analyses from Microsoft and Google's disclosure place the vulnerable code in the kernel's cryptographic driver (cng.sys). A local attacker with low privileges can trigger the overflow without user interaction, gaining code execution in kernel context and effectively full control of the host (high impact on confidentiality, integrity, and availability; CVSS 7.8). Every Windows system on the affected builds is exposed: Windows 10 versions 1507 through 20H2, Windows 7, 8.1, RT 8.1, and Windows Server 2008, which at disclosure meant essentially the entire supported Windows install base. The flaw was exploited as a zero-day in the wild: Google disclosed its use in targeted attacks, reportedly chained with a Chrome zero-day, and CISA added it to the KEV catalog on 2021-11-03; EPSS currently estimates a 5.4% probability of exploitation within 30 days (92nd percentile), with ransomware association listed as unknown. Do: Apply Microsoft's November 2020 Patch Tuesday security updates to all affected Windows 10, Windows 7, 8.1, RT 8.1, and Windows Server 2008 systems; this is CISA's required action for the KEV listing and no official workaround is known. Prioritize hosts where untrusted users can log on locally or via RDP, and ensure Chromium-based browsers are fully updated since this kernel bug was reportedly chained with a Chrome zero-day. After patching, verify the November 2020 update is installed; treat any ransomware association as currently unconfirmed. | 7.8 | 5% | KEV |
| mass≈1 billion+ devices (essentially the entire supported Windows install base at disclosure) | |
| CVE-2020-27955 | Git LFS 2.12.0 allows Remote Code Execution. Git LFS 2.12.0 allows Remote Code Execution. NVD description · AI analysis pending | 9.8 | 83% | PoC ×5 |
| — |
Full article1,060 words · extracted from helpnetsecurity.com · click to collapse
Here’s an overview of some of last week’s most interesting news, reviews and articles:
Git LFS vulnerability allows attackers to compromise targets’ Windows systems (CVE-2020-27955)
A critical vulnerability (CVE-2020-27955) in Git Large File Storage (Git LFS), an open source Git extension for versioning large files, allows attackers to achieve remote code execution if the Windows-using victim is tricked into cloning the attacker’s malicious repository using a vulnerable Git version control tool, security researcher Dawid Golunski has discovered.
November 2020 Patch Tuesday forecast: Significant OS changes ahead
November Patch Tuesday and the end-of-year holidays are rapidly approaching. Microsoft gave us a late release or maybe an early gift depending upon how you look at the new version of Windows 10. The Patch Tuesday updates appear to be light, so things are looking much better as we enter the final stretch for 2020.
Paying a ransom to prevent leaking of stolen data is a risky gamble
Ransomware groups have realized that their tactics are also very effective for targeting larger enterprises, and this resulted in a 31% increase of the average ransom payment in Q3 2020 (reaching $233,817), ransomware IR provider Coveware shared in a recently released report.
Ryuk ransomware behind one third of all ransomware attacks in 2020
There’s a growing use of ransomware, encrypted threats and attacks among cybercriminals leveraging non-standard ports, while overall malware volume declined for the third consecutive quarter, SonicWall reveals.
What is ad fraud and how can advertisers fight against it?
According to HP Enterprise’s Business of Hacking report, ad fraud is the easiest and most lucrative form of cybercrime, above activities such as credit card fraud, payment fraud and bank fraud. Luke Taylor, COO and Founder of TrafficGuard, explains why businesses should do what they can to detect and prevent it.
How to deal with the escalating phishing threat
In today’s world, most external cyberattacks start with phishing. For attackers, it’s almost a no-brainer: phishing is cheap and humans are fallible, even after going through anti-phishing training.
Google discloses actively exploited Windows zero-day (CVE-2020-17087)
Google researchers have made public a Windows kernel zero day vulnerability (CVE-2020-17087) that is being exploited in the wild in tandem with a Google Chrome flaw (CVE-2020-15999) that has been patched on October 20. Then the company patched two actively exploited Chrome zero-day vulnerabilities: CVE-2020-16009 is present in the desktop version of the browser, CVE-2020-16010 in the mobile (Android) version.
How smartphones became IoT’s best friend and worst enemy
Relying on the ubiquity of smartphones and the rise of remote controls, users and vendors alike have embraced the move away from physical device interfaces. This evolution in the IoT ecosystem, however, brings major benefits AND serious drawbacks.
Top tasks IT professionals are spending more time on
LogMeIn released a report that reveals the current state of IT in the new era of remote work. The report quantifies the impact of COVID-19 on IT roles and priorities for small to medium-sized businesses.
Quantum computers: How to prepare for this great threat to information security
Quantum computers also pose a big security problem. With exponentially higher processing power, they will be able to smash through the public-key encryption standards widely relied on today, threatening the security of all digital information and communication.
How do I select a compliance solution for my business?
To select a suitable compliance solution for your business, you need to think about a variety of factors. We’ve talked to several cybersecurity professionals to get their insight on the topic.
Review: Specops Password Policy
Specops Password Policy is a powerful tool for overcoming the limitations of the default password policies present in Microsoft Active Directory environments.
BEC attacks increase in most industries, invoice and payment fraud rise by 155%
BEC attacks increased 15% quarter-over-quarter, driven by an explosion in invoice and payment fraud, Abnormal Security research reveals.
The power of trusted endpoints
The vision of trusted endpoints is becoming a reality and finally, context-specific identities can be provisioned into most consumer devices.
Enterprise IT security teams continue to struggle
CyberEdge conducted a web-based survey of 600 enterprise IT security professionals from seven countries and 19 industries in August 2020 in an effort to understand how the pandemic has affected IT security budgets, personnel, cyber risks, and priorities for acquiring new security technologies.
Cybersecurity training: Learn how to secure containerized environments
For the last several years, Sheila A. Berta, Head of Security Research at Dreamlab Technologies, has been conducting investigations in a variety of information security areas like hardware hacking, car hacking, wireless security, malware and – more recently – Docker, Kubernetes and cloud security.
60% of organizations have accelerated their zero trust projects
The COVID-19 pandemic has not impacted the adoption of zero trust technology globally, a Pulse Secure report reveals. In fact, 60% of organizations said they have accelerated zero trust implementation during the pandemic.
Moving past the madness of manually updated X.509 certificates
One of the greatest advantages of the Microsoft CA is automation, but that advantage does not extend to endpoints outside the Windows environment.
Technology solutions providers must empower end users to improve cybersecurity standards
Despite the increasing sophistication of cyber attacks, TSPs that invest in key foundational, standardized approaches to training put their clients in a much stronger position.
Take back control of IT with cloud native IGA
It’s very difficult for organizations to maintain a highly customized code in their environments that the first generation of IGA products required. All those changes to the code will then need to be maintained. But modern IGA has learned from all the coding requirements of the past and now provides a much simpler way to give users different levels of access.
Report: Intelligent cyber threat response
Cybersecurity professionals know there are fundamental gaps in most cyber operations centers, one of which is the overwhelming level of effort required to understand cyber threat information.
Guide: 10 critical issues to cover in your vendor security questionnaires
In today’s perilous cyber world, companies must carefully check their vendors’ cyber posture, and the initial vetting of any third party typically begins with a comprehensive security questionnaire.
Video series: Get into the phisher’s mind
Check out this series to understand the phisher’s perspective and better defend your organization from cyber threats.
New infosec products of the week: November 6, 2020
A rundown of the most important infosec products released last week.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/11/08/week-in-review-windows-zero-day-exploited-patch-tuesday-forecast-selecting-a-compliance-solution/