Tageszusammenfassung - 26.08.2022

End-of-Day report

Timeframe: Donnerstag 25-08-2022 18:00 - Freitag 26-08-2022 18:00 Handler: Thomas Pribitzer Co-Handler: Michael Schlagenhaufer

News

Living off the land, AD CS style

Unless you have been living under a rock for the last year or so, Active Directory Certificate Services (AD CS) abuse continues to be a hot topic in offensive security, ever since the excellent research released by Will Schroeder (@harmj0y) and Lee Christensen (@tifkin_).

https://www.pentestpartners.com/security-blog/living-off-the-land-ad-cs-style/

Threat Assessment: Black Basta Ransomware

Black Basta is ransomware as a service (RaaS) that first emerged in April 2022. However, evidence suggests that it has been in development since February. The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom.

https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/

Automatic Execution of Code Upon Package Download on Python Package Manager

Automatic code execution is triggered upon downloading approximately one third of the packages on PyPi. A worrying feature in pip/PyPi allows code to automatically run when developers are merely downloading a package.

https://checkmarx.com/blog/automatic-execution-of-code-upon-package-download-on-python-package-manager/

Vulnerabilities

Lücken in Ciscos FXOS und NX-OS ermöglichen Übernahme der Kontrolle

In Ciscos Router- und Firewall-Betriebssystemen FXOS und NX-OS hätten Angreifer beliebigen Code mit root-Rechten ausführen können. Updates stehen bereit.

https://heise.de/-7244032

Security updates for Friday

Security updates have been issued by Debian (zlib), Fedora (dotnet3.1, firefox, java-1.8.0-openjdk-aarch32, thunderbird, and zlib), Mageia (canna, chromium-browser-stable, dovecot, firefox/nss, freeciv, freetype2, gnutls, kernel, kernel-linus, kicad, ldb/samba/sssd, libgsasl, microcode, nodejs, rsync, thunderbird, and unbound), Oracle (php:7.4 and systemd), Scientific Linux (firefox, rsync, systemd, and thunderbird), Slackware (vim), and SUSE (bluez, gstreamer-plugins-good, java-1_7_1-ibm, java-1_8_0-ibm, kernel, libcroco, postgresql10, postgresql13, python-lxml, and webkit2gtk3).

https://lwn.net/Articles/906232/

CISA Adds Ten Known Exploited Vulnerabilities to Catalog

CISA has added ten new vulnerabilities to its-Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise.

https://us-cert.cisa.gov/ncas/current-activity/2022/08/25/cisa-adds-ten-known-exploited-vulnerabilities-catalog

[R1] Nessus Agent Version 8.3.4 Fixes Multiple Vulnerabilities

Custom audit files bring tremendous power and flexibility when assessing the configuration of your assets. Two separate vulnerabilities that utilize this custom Audit functionality were identified, reported and fixed. With the release of Nessus Agent 8.3.4, Tenable has mitigated the reported issues by enabling the ability to sign and verify custom audit files.

https://www.tenable.com/security/tns-2022-17

ABB Security Advisory: ARM600 Cyber Security Notification: UEFI vulnerability

https://search.abb.com/library/Download.aspx?DocumentID=2NGA001477&LanguageCode=en&DocumentPartId=&Action=Launch

Security Bulletin: Vulnerability in IBM Java Runtime(CVE-2021-35603) affects DB2 Recovery Expert for Linux, Unix and Windows

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-ibm-java-runtimecve-2021-35603-affects-db2-recovery-expert-for-linux-unix-and-windows/

Security Bulletin: Multiple Security Vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-may-affect-ibm-robotic-process-automation-for-cloud-pak-4/

Security Bulletin: IBM MQ is vulnerable to issues with libcurl (CVE-2022-27780, CVE-2022-30115)

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-is-vulnerable-to-issues-with-libcurl-cve-2022-27780-cve-2022-30115-2/

Security Bulletin: IBM DataPower Gateway vulnerable to CSRF attack

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-datapower-gateway-vulnerable-to-csrf-attack/

Security Bulletin: IBM Maximo Asset Management and the IBM Maximo Manage application in IBM Maximo Application Suite are vulnerable to cross-site scripting (CVE-2022-35714)

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-maximo-asset-management-and-the-ibm-maximo-manage-application-in-ibm-maximo-application-suite-are-vulnerable-to-cross-site-scripting-cve-2022-35714/

Security Bulletin: Multiple vulnerabilities may affect IBM Robotic Process Automation for Cloud Pak

https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-may-affect-ibm-robotic-process-automation-for-cloud-pak/

Security Bulletin: IBM Security Directory Integrator as shipped with IBM Security Directory Suite is affected by Apache Log4j vulnerability (CVE-2021-4104)

https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-directory-integrator-as-shipped-with-ibm-security-directory-suite-is-affected-by-apache-log4j-vulnerability-cve-2021-4104/

Security Bulletin: Enterprise Content Management System Monitor is affected by a vulnerability in Java SE related to the JSSE component

https://www.ibm.com/blogs/psirt/security-bulletin-enterprise-content-management-system-monitor-is-affected-by-a-vulnerability-in-java-se-related-to-the-jsse-component/