[CERT-daily] Tageszusammenfassung - 26.08.2022

Fri Aug 26 18:59:16 CEST 2022

=====================
= End-of-Day report =
=====================

Timeframe:   Donnerstag 25-08-2022 18:00 − Freitag 26-08-2022 18:00
Handler:     Thomas Pribitzer
Co-Handler:  Michael Schlagenhaufer

=====================
=       News        =
=====================

∗∗∗ Living off the land, AD CS style ∗∗∗
---------------------------------------------
Unless you have been living under a rock for the last year or so,  Active Directory Certificate Services (AD CS) abuse continues to be a hot topic in offensive security, ever since the excellent research released by Will Schroeder (@harmj0y) and Lee Christensen (@tifkin_).
---------------------------------------------
https://www.pentestpartners.com/security-blog/living-off-the-land-ad-cs-style/


∗∗∗ Threat Assessment: Black Basta Ransomware ∗∗∗
---------------------------------------------
Black Basta is ransomware as a service (RaaS) that first emerged in April 2022. However, evidence suggests that it has been in development since February. The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom.
---------------------------------------------
https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/


∗∗∗ Automatic Execution of Code Upon Package Download on Python Package Manager ∗∗∗
---------------------------------------------
Automatic code execution is triggered upon downloading approximately one third of the packages on PyPi. A worrying feature in pip/PyPi allows code to automatically run when developers are merely downloading a package.
---------------------------------------------
https://checkmarx.com/blog/automatic-execution-of-code-upon-package-download-on-python-package-manager/


=====================
=  Vulnerabilities  =
=====================

∗∗∗ Lücken in Ciscos FXOS und NX-OS ermöglichen Übernahme der Kontrolle ∗∗∗
---------------------------------------------
In Ciscos Router- und Firewall-Betriebssystemen FXOS und NX-OS hätten Angreifer beliebigen Code mit root-Rechten ausführen können. Updates stehen bereit.
---------------------------------------------
https://heise.de/-7244032


∗∗∗ Security updates for Friday ∗∗∗
---------------------------------------------
Security updates have been issued by Debian (zlib), Fedora (dotnet3.1, firefox, java-1.8.0-openjdk-aarch32, thunderbird, and zlib), Mageia (canna, chromium-browser-stable, dovecot, firefox/nss, freeciv, freetype2, gnutls, kernel, kernel-linus, kicad, ldb/samba/sssd, libgsasl, microcode, nodejs, rsync, thunderbird, and unbound), Oracle (php:7.4 and systemd), Scientific Linux (firefox, rsync, systemd, and thunderbird), Slackware (vim), and SUSE (bluez, gstreamer-plugins-good, java-1_7_1-ibm, java-1_8_0-ibm, kernel, libcroco, postgresql10, postgresql13, python-lxml, and webkit2gtk3).
---------------------------------------------
https://lwn.net/Articles/906232/


∗∗∗ CISA Adds Ten Known Exploited Vulnerabilities to Catalog ∗∗∗
---------------------------------------------
CISA has added ten new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.
---------------------------------------------
https://us-cert.cisa.gov/ncas/current-activity/2022/08/25/cisa-adds-ten-known-exploited-vulnerabilities-catalog


∗∗∗ [R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities ∗∗∗
---------------------------------------------
Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified, reported and fixed. With the release of Nessus Agent 8.3.4, Tenable has mitigated the reported issues by enabling the ability to sign and verify custom audit files. 
---------------------------------------------
https://www.tenable.com/security/tns-2022-17


∗∗∗ ABB Security Advisory: ARM600 Cyber Security Notification: UEFI vulnerability ∗∗∗
---------------------------------------------
https://search.abb.com/library/Download.aspx?DocumentID=2NGA001477&LanguageCode=en&DocumentPartId=&Action=Launch


∗∗∗ Security Bulletin: Vulnerability in IBM Java Runtime(CVE-2021-35603) affects DB2 Recovery Expert for Linux, Unix and Windows ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java-runtimecve-2021-35603-affects-db2-recovery-expert-for-linux-unix-and-windows/


∗∗∗ Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-may-affect-ibm-robotic-process-automation-for-cloud-pak-4/


∗∗∗ Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-issues-with-libcurl-cve-2022-27780-cve-2022-30115-2/


∗∗∗ Security Bulletin: IBM DataPower Gateway vulnerable to CSRF attack ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-vulnerable-to-csrf-attack/


∗∗∗ Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-35714) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-and-the-ibm-maximo-manage-application-in-ibm-maximo-application-suite-are-vulnerable-to-cross-site-scripting-cve-2022-35714/


∗∗∗ Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-may-affect-ibm-robotic-process-automation-for-cloud-pak/


∗∗∗ Security Bulletin: IBM Security Directory Integrator as shipped with IBM Security Directory Suite is affected by Apache Log4j vulnerability (CVE-2021-4104) ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-directory-integrator-as-shipped-with-ibm-security-directory-suite-is-affected-by-apache-log4j-vulnerability-cve-2021-4104/


∗∗∗ Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in Java SE related to the JSSE component ∗∗∗
---------------------------------------------
https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-management-system-monitor-is-affected-by-a-vulnerability-in-java-se-related-to-the-jsse-component/


∗∗∗ F5: K42795243: Apache Xalan Java Library vulnerability CVE-2022-34169 ∗∗∗
---------------------------------------------
https://support.f5.com/csp/article/K42795243


∗∗∗ WebKitGTK and WPE WebKit Security Advisory WSA-2022-0008 ∗∗∗
---------------------------------------------
https://webkitgtk.org/security/WSA-2022-0008.html


∗∗∗ vBulletin Connect: Schwachstelle ermöglicht nicht spezifizierten Angriff ∗∗∗
---------------------------------------------
https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-1190

-- 
CERT.at Daily mailing list
Listinfo: https://lists.cert.at/cgi-bin/mailman/listinfo/daily