Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Multiple government agencies has published an advisory on an ongoing APT campaign targeting Cisco ASA / FTD devices using post-auth RCE bug CVE-2024-20359 and CVE-2024-20358.

They don't know how the attackers initially got in.

Important note from the research published by Cisco Talos calling the APT operation* "ArcaneDoor":

> We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date. Our investigation is ongoing, and we will provide updates, if necessary, in the security advisories or on this blog.

https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

While Cisco's Event Response lists CVE-2024-20358 as "leveraged in these attacks," its own security advisory states:

The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

🔗 CVE-2024-20358 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability

CISA's RSS feed showed that the security alert for the KEV additions created at 0800 ET, meaning it was coordinated and prepared in advance of Cisco's announcements. Because CISA only added the other two Cisco vulnerabilities, CVE-2024-20358 does not appear to be a known exploited vulnerability.

#Cisco #vulnerability #CVE_2024_202358 #ASA

Multiple government agencies has published an advisory on an ongoing APT campaign targeting Cisco ASA / FTD devices using post-auth RCE bug CVE-2024-20359 and CVE-2024-20358.

They don't know how the attackers initially got in.

Important note from the research published by Cisco Talos calling the APT operation* "ArcaneDoor":

> We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date. Our investigation is ongoing, and we will provide updates, if necessary, in the security advisories or on this blog.

https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

While Cisco's Event Response lists CVE-2024-20358 as "leveraged in these attacks," its own security advisory states:

The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory.

🔗 CVE-2024-20358 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability

CISA's RSS feed showed that the security alert for the KEV additions created at 0800 ET, meaning it was coordinated and prepared in advance of Cisco's announcements. Because CISA only added the other two Cisco vulnerabilities, CVE-2024-20358 does not appear to be a known exploited vulnerability.

#Cisco #vulnerability #CVE_2024_202358 #ASA

Vulnerability in R Programming Language Could Fuel Supply Chain Attacks https://www.securityweek.com/vulnerability-in-r-programming-language-enables-supply-chain-attacks/ #Vulnerabilities #vulnerability #CVE202427322 #Featured

Vulnerability in R Programming Language Could Fuel Supply Chain Attacks https://www.securityweek.com/vulnerability-in-r-programming-language-enables-supply-chain-attacks/ #Vulnerabilities #vulnerability #CVE202427322 #Featured

CVE-2024-27322, if you missed this:. #cybersecurity #infosec

Vulnerability in R Programming Language Enables Supply Chain Attacks https://www.securityweek.com/vulnerability-in-r-programming-language-enables-supply-chain-attacks/ @SecurityWeek

The CVE-2024-27322 security vulnerability in R's deserialization process gives attackers a way to execute arbitrary code in target environments via specially crafted files. https://www.darkreading.com/application-security/r-programming-language-exposes-orgs-to-supply-chain-risk

🚨Looks like #RStats was not immune to deserialization bugs after all https://hiddenlayer.com/research/r-bitrary-code-execution/

Watch those R Data files (and, we now shld come up with better ways to ensure local R library integrity)!!

CVE-2024-27322

CVE-2024-27322, if you missed this:. #cybersecurity #infosec

Vulnerability in R Programming Language Enables Supply Chain Attacks https://www.securityweek.com/vulnerability-in-r-programming-language-enables-supply-chain-attacks/ @SecurityWeek

The CVE-2024-27322 security vulnerability in R's deserialization process gives attackers a way to execute arbitrary code in target environments via specially crafted files. https://www.darkreading.com/application-security/r-programming-language-exposes-orgs-to-supply-chain-risk

🚨Looks like #RStats was not immune to deserialization bugs after all https://hiddenlayer.com/research/r-bitrary-code-execution/

Watch those R Data files (and, we now shld come up with better ways to ensure local R library integrity)!!

CVE-2024-27322

Hackers Exploit WP-Automatic Plugin Vulnerability, Threatening WordPress Site Security https://thecyberexpress.com/wp-automatic-plugin-vulnerability/ #WPAutomaticpluginvulnerabilities #WPAutomaticPluginVulnerability #criticalvulnerability #TheCyberExpressNews #WPAutomaticplugin #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202427956

SolarWinds security advisory: SolarWinds Platform Arbitrary Open Redirection Vulnerability (CVE-2024-28076)
CVE-2024-28076 (7.0 high, disclosed 18 April 2024) arbitrary open redirection vulnerability. If exploited, a potential attacker can redirect to a different domain when using URL parameter with relative entry in the correct format.

Interestingly, SolarWinds wrote the vector as CVSS:7.0/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
I didn't know we were up to CVSSv7!!

#CVE_2024_28076 #SolarWinds #PatchTuesday #vulnerability

SolarWinds security advisory: SolarWinds Platform Arbitrary Open Redirection Vulnerability (CVE-2024-28076)
CVE-2024-28076 (7.0 high, disclosed 18 April 2024) arbitrary open redirection vulnerability. If exploited, a potential attacker can redirect to a different domain when using URL parameter with relative entry in the correct format.

Interestingly, SolarWinds wrote the vector as CVSS:7.0/AV:A/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:L
I didn't know we were up to CVSSv7!!

#CVE_2024_28076 #SolarWinds #PatchTuesday #vulnerability

Buffer Overflow in GNU C Library Affects Older Versions

Date: April 17, 2024

CVE: CVE-2024-2961

Vulnerability Type: Out-of-bounds Write

CWE: [[CWE-787]]

Sources: SecurityVulnerability.io, NVD Mitigation blog

Issue Summary

A critical buffer overflow vulnerability has been identified in the GNU C Library's iconv function when converting charsets to certain Chinese Extended encodings. This flaw occurs when converting strings to the ISO-2022-CN-EXT character set in versions prior to 2.40, potentially leading to application crashes or memory corruption.

Technical Key Findings

The vulnerability stems from improper boundary checks during character set conversion, allowing up to 4 bytes of overflow. This could enable attackers to execute arbitrary code or disrupt program operation by manipulating memory locations adjacent to the buffer.

Vulnerable Products

All versions of GNU C Library older than 2.40 are susceptible. (That's potentially 24 years of a buffer overflow presence in the glibc!)

Impact Assessment

The vulnerability poses a high risk, potentially affecting the confidentiality, integrity, and availability of systems utilizing the affected library versions. There is no evidence of active exploitation yet, but the severity of potential impacts warrants prompt attention.

Patches or Workaround

The GNU C Library has released patches for this vulnerability. Users are advised to update to version 2.40 or later. If you are unable to (or it's not available on your OS yet), you can mitigate this issue by disabling the affected charsets in gconv.

Check if you are vulnerable

// The first line of the linker version info should include the version of glibc (either as GLIBC or GNU libc).

ldd --version

// Check if the vulnerable encodings are enabled in iconv:

iconv -l | grep -E 'CN-?EXT'

If they are, you will see an output like:

ISO-2022-CN-EXT//
ISO2022CNEXT//

Tags

#GNUCLibrary #CVE-2024-2961 #BufferOverflow #SecurityPatch #ISO2022CNEXT #CVE20242961 #iconv #iconvglibc

I wonder if GLIBC-SA-2024-0004 / CVE-2024-2961 "iconv() out-of-bound writes when writing escape sequence" might allow exploitation in some setuid binaries. Being limited to fixed values '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H' for the overwrite does place fairly significant limitations, however. I believe it would have to be very specific scenario to be exploitable (maybe affecting code flow by setting some variable to nonzero)
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 #GLIBCSA20240004 #CVE20242961 #vulnerability #infosec #cybersecurity

Buffer Overflow in GNU C Library Affects Older Versions

Date: April 17, 2024

CVE: CVE-2024-2961

Vulnerability Type: Out-of-bounds Write

CWE: [[CWE-787]]

Sources: SecurityVulnerability.io, NVD Mitigation blog

Issue Summary

A critical buffer overflow vulnerability has been identified in the GNU C Library's iconv function when converting charsets to certain Chinese Extended encodings. This flaw occurs when converting strings to the ISO-2022-CN-EXT character set in versions prior to 2.40, potentially leading to application crashes or memory corruption.

Technical Key Findings

The vulnerability stems from improper boundary checks during character set conversion, allowing up to 4 bytes of overflow. This could enable attackers to execute arbitrary code or disrupt program operation by manipulating memory locations adjacent to the buffer.

Vulnerable Products

All versions of GNU C Library older than 2.40 are susceptible. (That's potentially 24 years of a buffer overflow presence in the glibc!)

Impact Assessment

The vulnerability poses a high risk, potentially affecting the confidentiality, integrity, and availability of systems utilizing the affected library versions. There is no evidence of active exploitation yet, but the severity of potential impacts warrants prompt attention.

Patches or Workaround

The GNU C Library has released patches for this vulnerability. Users are advised to update to version 2.40 or later. If you are unable to (or it's not available on your OS yet), you can mitigate this issue by disabling the affected charsets in gconv.

Check if you are vulnerable

// The first line of the linker version info should include the version of glibc (either as GLIBC or GNU libc).

ldd --version

// Check if the vulnerable encodings are enabled in iconv:

iconv -l | grep -E 'CN-?EXT'

If they are, you will see an output like:

ISO-2022-CN-EXT//
ISO2022CNEXT//

Tags

#GNUCLibrary #CVE-2024-2961 #BufferOverflow #SecurityPatch #ISO2022CNEXT #CVE20242961 #iconv #iconvglibc

I wonder if GLIBC-SA-2024-0004 / CVE-2024-2961 "iconv() out-of-bound writes when writing escape sequence" might allow exploitation in some setuid binaries. Being limited to fixed values '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H' for the overwrite does place fairly significant limitations, however. I believe it would have to be very specific scenario to be exploitable (maybe affecting code flow by setting some variable to nonzero)
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 #GLIBCSA20240004 #CVE20242961 #vulnerability #infosec #cybersecurity

Oh just PHP apps? NBD #CVE_2024_2961 #ThreatIntel

securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

The vulnerability, cataloged under CVE-2024-2961 and rated 8.8 on the CVSS scale, resides in the ISO-2022-CN-EXT plugin of the glibc’s iconv library. This critical flaw occurs during the charset conversion process from UCS4, where specific escape characters are required to signify changes in the charset to the library. However, due to insufficient boundary checks on internal buffers, an out-of-bounds write can occur, allowing up to three bytes to be written outside the intended memory area.

This vulnerability poses a significant risk as it compromises the Integrity, Confidentiality, and Availability (ICA) triad by potentially allowing attackers to craft malicious character sequences that trigger the out-of-bounds write, leading to remote code execution. The exploitation of this flaw could result in application crashes, arbitrary memory corruption, data overwrites, and even system takeovers.

Oh just PHP apps? NBD #CVE_2024_2961 #ThreatIntel

securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

The vulnerability, cataloged under CVE-2024-2961 and rated 8.8 on the CVSS scale, resides in the ISO-2022-CN-EXT plugin of the glibc’s iconv library. This critical flaw occurs during the charset conversion process from UCS4, where specific escape characters are required to signify changes in the charset to the library. However, due to insufficient boundary checks on internal buffers, an out-of-bounds write can occur, allowing up to three bytes to be written outside the intended memory area.

This vulnerability poses a significant risk as it compromises the Integrity, Confidentiality, and Availability (ICA) triad by potentially allowing attackers to craft malicious character sequences that trigger the out-of-bounds write, leading to remote code execution. The exploitation of this flaw could result in application crashes, arbitrary memory corruption, data overwrites, and even system takeovers.

Buffer Overflow in GNU C Library Affects Older Versions

Date: April 17, 2024

CVE: CVE-2024-2961

Vulnerability Type: Out-of-bounds Write

CWE: [[CWE-787]]

Sources: SecurityVulnerability.io, NVD Mitigation blog

Issue Summary

A critical buffer overflow vulnerability has been identified in the GNU C Library's iconv function when converting charsets to certain Chinese Extended encodings. This flaw occurs when converting strings to the ISO-2022-CN-EXT character set in versions prior to 2.40, potentially leading to application crashes or memory corruption.

Technical Key Findings

The vulnerability stems from improper boundary checks during character set conversion, allowing up to 4 bytes of overflow. This could enable attackers to execute arbitrary code or disrupt program operation by manipulating memory locations adjacent to the buffer.

Vulnerable Products

All versions of GNU C Library older than 2.40 are susceptible. (That's potentially 24 years of a buffer overflow presence in the glibc!)

Impact Assessment

The vulnerability poses a high risk, potentially affecting the confidentiality, integrity, and availability of systems utilizing the affected library versions. There is no evidence of active exploitation yet, but the severity of potential impacts warrants prompt attention.

Patches or Workaround

The GNU C Library has released patches for this vulnerability. Users are advised to update to version 2.40 or later. If you are unable to (or it's not available on your OS yet), you can mitigate this issue by disabling the affected charsets in gconv.

Check if you are vulnerable

// The first line of the linker version info should include the version of glibc (either as GLIBC or GNU libc).

ldd --version

// Check if the vulnerable encodings are enabled in iconv:

iconv -l | grep -E 'CN-?EXT'

If they are, you will see an output like:

ISO-2022-CN-EXT//
ISO2022CNEXT//

Tags

#GNUCLibrary #CVE-2024-2961 #BufferOverflow #SecurityPatch #ISO2022CNEXT #CVE20242961 #iconv #iconvglibc

I wonder if GLIBC-SA-2024-0004 / CVE-2024-2961 "iconv() out-of-bound writes when writing escape sequence" might allow exploitation in some setuid binaries. Being limited to fixed values '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H' for the overwrite does place fairly significant limitations, however. I believe it would have to be very specific scenario to be exploitable (maybe affecting code flow by setting some variable to nonzero)
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 #GLIBCSA20240004 #CVE20242961 #vulnerability #infosec #cybersecurity

Buffer Overflow in GNU C Library Affects Older Versions

Date: April 17, 2024

CVE: CVE-2024-2961

Vulnerability Type: Out-of-bounds Write

CWE: [[CWE-787]]

Sources: SecurityVulnerability.io, NVD Mitigation blog

Issue Summary

A critical buffer overflow vulnerability has been identified in the GNU C Library's iconv function when converting charsets to certain Chinese Extended encodings. This flaw occurs when converting strings to the ISO-2022-CN-EXT character set in versions prior to 2.40, potentially leading to application crashes or memory corruption.

Technical Key Findings

The vulnerability stems from improper boundary checks during character set conversion, allowing up to 4 bytes of overflow. This could enable attackers to execute arbitrary code or disrupt program operation by manipulating memory locations adjacent to the buffer.

Vulnerable Products

All versions of GNU C Library older than 2.40 are susceptible. (That's potentially 24 years of a buffer overflow presence in the glibc!)

Impact Assessment

The vulnerability poses a high risk, potentially affecting the confidentiality, integrity, and availability of systems utilizing the affected library versions. There is no evidence of active exploitation yet, but the severity of potential impacts warrants prompt attention.

Patches or Workaround

The GNU C Library has released patches for this vulnerability. Users are advised to update to version 2.40 or later. If you are unable to (or it's not available on your OS yet), you can mitigate this issue by disabling the affected charsets in gconv.

Check if you are vulnerable

// The first line of the linker version info should include the version of glibc (either as GLIBC or GNU libc).

ldd --version

// Check if the vulnerable encodings are enabled in iconv:

iconv -l | grep -E 'CN-?EXT'

If they are, you will see an output like:

ISO-2022-CN-EXT//
ISO2022CNEXT//

Tags

#GNUCLibrary #CVE-2024-2961 #BufferOverflow #SecurityPatch #ISO2022CNEXT #CVE20242961 #iconv #iconvglibc

I wonder if GLIBC-SA-2024-0004 / CVE-2024-2961 "iconv() out-of-bound writes when writing escape sequence" might allow exploitation in some setuid binaries. Being limited to fixed values '$+I', '$+J', '$+K', '$+L', '$+M', or '$*H' for the overwrite does place fairly significant limitations, however. I believe it would have to be very specific scenario to be exploitable (maybe affecting code flow by setting some variable to nonzero)
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004 #GLIBCSA20240004 #CVE20242961 #vulnerability #infosec #cybersecurity

Oh just PHP apps? NBD #CVE_2024_2961 #ThreatIntel

securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

The vulnerability, cataloged under CVE-2024-2961 and rated 8.8 on the CVSS scale, resides in the ISO-2022-CN-EXT plugin of the glibc’s iconv library. This critical flaw occurs during the charset conversion process from UCS4, where specific escape characters are required to signify changes in the charset to the library. However, due to insufficient boundary checks on internal buffers, an out-of-bounds write can occur, allowing up to three bytes to be written outside the intended memory area.

This vulnerability poses a significant risk as it compromises the Integrity, Confidentiality, and Availability (ICA) triad by potentially allowing attackers to craft malicious character sequences that trigger the out-of-bounds write, leading to remote code execution. The exploitation of this flaw could result in application crashes, arbitrary memory corruption, data overwrites, and even system takeovers.

Oh just PHP apps? NBD #CVE_2024_2961 #ThreatIntel

securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

The vulnerability, cataloged under CVE-2024-2961 and rated 8.8 on the CVSS scale, resides in the ISO-2022-CN-EXT plugin of the glibc’s iconv library. This critical flaw occurs during the charset conversion process from UCS4, where specific escape characters are required to signify changes in the charset to the library. However, due to insufficient boundary checks on internal buffers, an out-of-bounds write can occur, allowing up to three bytes to be written outside the intended memory area.

This vulnerability poses a significant risk as it compromises the Integrity, Confidentiality, and Availability (ICA) triad by potentially allowing attackers to craft malicious character sequences that trigger the out-of-bounds write, leading to remote code execution. The exploitation of this flaw could result in application crashes, arbitrary memory corruption, data overwrites, and even system takeovers.

CVE-2024-2961 - glibc Vulnerability Opens Door to PHP Attacks: Patch Immediately https://securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

#glibc Vulnerability Opens Door to #PHP Attacks

https://securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

#cybersecurity #FOSS #CVE

glibc iconv buffer overflow vulnerability that can be used for remote code execution on servers running PHP. Present for 24 years. This is the kind of stuff Rust was made for.

- https://www.openwall.com/lists/oss-security/2024/04/18/4
- https://nvd.nist.gov/vuln/detail/CVE-2024-2961
- https://rockylinux.org/news/glibc-vulnerability-april-2024/

A vulnerability (CVE-2024-2961) that may affect PHP applications is receiving patches on many operating systems. It's advised to update & restart your systems where patches are available.

Ubuntu/Debian/Fedora appear to have patches available for supported systems. Rocky has some checking/workaround guidance here:

https://rockylinux.org/news/glibc-vulnerability-april-2024/

There is a new PHP vulnerability out. It is being tracked as CVE-2024-2961. Here’s a video explaining the vulnerability https://youtu.be/u8jLUjpCWrs?si=Fm1JSBdAW9VBzuhj #cve #vulnerability #hacking #php #linux #news #Security

tl;dr: upgrade glibc on your servers!

Summing it up, there's a vulnerability (CVE-2024-2961) on glibc that, apparently, can be used to get RCE on servers running PHP.
It's recommended that you update glibc to a patched version.

https://security-tracker.debian.org/tracker/CVE-2024-2961
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-2961

There's an upcoming talk on May 10 where the researcher will explain how it was used to hack PHP servers.

https://www.offensivecon.org/speakers/2024/charles-fol.html

#PHP #glibc #iconv

@ramsey it's this one CVE-2024-2961 https://security-tracker.debian.org/tracker/CVE-2024-2961

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2024-2961/

CVE-2024-2961 - glibc Vulnerability Opens Door to PHP Attacks: Patch Immediately https://securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

#glibc Vulnerability Opens Door to #PHP Attacks

https://securityonline.info/cve-2024-2961-glibc-vulnerability-opens-door-to-php-attacks-patch-immediately/

#cybersecurity #FOSS #CVE

glibc iconv buffer overflow vulnerability that can be used for remote code execution on servers running PHP. Present for 24 years. This is the kind of stuff Rust was made for.

- https://www.openwall.com/lists/oss-security/2024/04/18/4
- https://nvd.nist.gov/vuln/detail/CVE-2024-2961
- https://rockylinux.org/news/glibc-vulnerability-april-2024/

A vulnerability (CVE-2024-2961) that may affect PHP applications is receiving patches on many operating systems. It's advised to update & restart your systems where patches are available.

Ubuntu/Debian/Fedora appear to have patches available for supported systems. Rocky has some checking/workaround guidance here:

https://rockylinux.org/news/glibc-vulnerability-april-2024/

There is a new PHP vulnerability out. It is being tracked as CVE-2024-2961. Here’s a video explaining the vulnerability https://youtu.be/u8jLUjpCWrs?si=Fm1JSBdAW9VBzuhj #cve #vulnerability #hacking #php #linux #news #Security

tl;dr: upgrade glibc on your servers!

Summing it up, there's a vulnerability (CVE-2024-2961) on glibc that, apparently, can be used to get RCE on servers running PHP.
It's recommended that you update glibc to a patched version.

https://security-tracker.debian.org/tracker/CVE-2024-2961
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2024-2961

There's an upcoming talk on May 10 where the researcher will explain how it was used to hack PHP servers.

https://www.offensivecon.org/speakers/2024/charles-fol.html

#PHP #glibc #iconv

@ramsey it's this one CVE-2024-2961 https://security-tracker.debian.org/tracker/CVE-2024-2961

"No way to prevent this" say users of only language where this regularly happens

https://xeiaso.net/shitposts/no-way-to-prevent-this/CVE-2024-2961/

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

Microsoft Security Response Center (MSRC) also dropped 14 security advisories because these "vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable." Click on this reply to see the original toot about Google Chrome's security advisory blog post. No mention of exploitation, no CVSSv3 scores provided.

1. CVE-2024-3832 Chromium: CVE-2024-3832 Object corruption in V8
2. CVE-2024-3833 Chromium: CVE-2024-3833 Object corruption in WebAssembly
3. CVE-2024-3914 Chromium: CVE-2024-3914 Use after free in V8
4. CVE-2024-3834 Chromium: CVE-2024-3834 Use after free in Downloads
5. CVE-2024-3837 Chromium: CVE-2024-3837 Use after free in QUIC
6. CVE-2024-3838 Chromium: CVE-2024-3838 Inappropriate implementation in Autofill
7. CVE-2024-3839 Chromium: CVE-2024-3839 Out of bounds read in Fonts
8. CVE-2024-3840 Chromium: CVE-2024-3840 Insufficient policy enforcement in Site Isolation
9. CVE-2024-3841 Chromium: CVE-2024-3841 Insufficient data validation in Browser Switcher
10. CVE-2024-3843 Chromium: CVE-2024-3843 Insufficient data validation in Downloads
11. CVE-2024-3844 Chromium: CVE-2024-3844 Inappropriate implementation in Extensions
12. CVE-2024-3845 Chromium: CVE-2024-3845 Inappropriate implementation in Network
13. CVE-2024-3846 Chromium: CVE-2024-3846 Inappropriate implementation in Prompts
14. CVE-2024-3847 Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI

#Microsoft #Chromium #Chrome #vulnerability

QNAP security advisory: Multiple Vulnerabilities in QTS, QuTS hero, QuTScloud, myQNAPcloud, and myQNAPcloud Link (PWN2OWN 2023)

• CVE-2024-21899 (9.8 critical) improper authentication vulnerability could allow users to compromise the security of the system via a network
• CVE-2024-21900 (6.5 medium) injection vulnerability could allow authenticated users to execute commands via a network
• CVE-2024-21901 (4.7 medium) SQL injection vulnerability could allow authenticated administrators to inject malicious code via a network
• CVE-2024-27124 (7.5 high) OS command injection vulnerability could allow users to execute commands via a network
• CVE-2024-32764 (9.9 critical) missing authentication for critical function vulnerability could allow unprivileged users to gain access to and execute certain functions via a network
• CVE-2024-32766 (10.0 critical 🥳) OS command injection vulnerability could allow users to execute commands via a network

QNAP added 3 additional CVEs to a 09 March 2024 advisory: CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. QNAP hid the CVSSv3 scores, which isn't surprising given how disgustingly severe they were. No mention of exploitation.

#QNAP #vulnerability #CVE_2024_27124 #CVE_2024_32764 #CVE_2024_32766

QNAP security advisory: Multiple Vulnerabilities in QTS, QuTS hero, QuTScloud, myQNAPcloud, and myQNAPcloud Link (PWN2OWN 2023)

• CVE-2024-21899 (9.8 critical) improper authentication vulnerability could allow users to compromise the security of the system via a network
• CVE-2024-21900 (6.5 medium) injection vulnerability could allow authenticated users to execute commands via a network
• CVE-2024-21901 (4.7 medium) SQL injection vulnerability could allow authenticated administrators to inject malicious code via a network
• CVE-2024-27124 (7.5 high) OS command injection vulnerability could allow users to execute commands via a network
• CVE-2024-32764 (9.9 critical) missing authentication for critical function vulnerability could allow unprivileged users to gain access to and execute certain functions via a network
• CVE-2024-32766 (10.0 critical 🥳) OS command injection vulnerability could allow users to execute commands via a network

QNAP added 3 additional CVEs to a 09 March 2024 advisory: CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. QNAP hid the CVSSv3 scores, which isn't surprising given how disgustingly severe they were. No mention of exploitation.

#QNAP #vulnerability #CVE_2024_27124 #CVE_2024_32764 #CVE_2024_32766

QNAP security advisory: Multiple Vulnerabilities in QTS, QuTS hero, QuTScloud, myQNAPcloud, and myQNAPcloud Link (PWN2OWN 2023)

• CVE-2024-21899 (9.8 critical) improper authentication vulnerability could allow users to compromise the security of the system via a network
• CVE-2024-21900 (6.5 medium) injection vulnerability could allow authenticated users to execute commands via a network
• CVE-2024-21901 (4.7 medium) SQL injection vulnerability could allow authenticated administrators to inject malicious code via a network
• CVE-2024-27124 (7.5 high) OS command injection vulnerability could allow users to execute commands via a network
• CVE-2024-32764 (9.9 critical) missing authentication for critical function vulnerability could allow unprivileged users to gain access to and execute certain functions via a network
• CVE-2024-32766 (10.0 critical 🥳) OS command injection vulnerability could allow users to execute commands via a network

QNAP added 3 additional CVEs to a 09 March 2024 advisory: CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. QNAP hid the CVSSv3 scores, which isn't surprising given how disgustingly severe they were. No mention of exploitation.

#QNAP #vulnerability #CVE_2024_27124 #CVE_2024_32764 #CVE_2024_32766

QNAP security advisory: Multiple Vulnerabilities in QTS, QuTS hero, QuTScloud, myQNAPcloud, and myQNAPcloud Link (PWN2OWN 2023)

• CVE-2024-21899 (9.8 critical) improper authentication vulnerability could allow users to compromise the security of the system via a network
• CVE-2024-21900 (6.5 medium) injection vulnerability could allow authenticated users to execute commands via a network
• CVE-2024-21901 (4.7 medium) SQL injection vulnerability could allow authenticated administrators to inject malicious code via a network
• CVE-2024-27124 (7.5 high) OS command injection vulnerability could allow users to execute commands via a network
• CVE-2024-32764 (9.9 critical) missing authentication for critical function vulnerability could allow unprivileged users to gain access to and execute certain functions via a network
• CVE-2024-32766 (10.0 critical 🥳) OS command injection vulnerability could allow users to execute commands via a network

QNAP added 3 additional CVEs to a 09 March 2024 advisory: CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. QNAP hid the CVSSv3 scores, which isn't surprising given how disgustingly severe they were. No mention of exploitation.

#QNAP #vulnerability #CVE_2024_27124 #CVE_2024_32764 #CVE_2024_32766

QNAP security advisory: Multiple Vulnerabilities in QTS, QuTS hero, QuTScloud, myQNAPcloud, and myQNAPcloud Link (PWN2OWN 2023)

• CVE-2024-21899 (9.8 critical) improper authentication vulnerability could allow users to compromise the security of the system via a network
• CVE-2024-21900 (6.5 medium) injection vulnerability could allow authenticated users to execute commands via a network
• CVE-2024-21901 (4.7 medium) SQL injection vulnerability could allow authenticated administrators to inject malicious code via a network
• CVE-2024-27124 (7.5 high) OS command injection vulnerability could allow users to execute commands via a network
• CVE-2024-32764 (9.9 critical) missing authentication for critical function vulnerability could allow unprivileged users to gain access to and execute certain functions via a network
• CVE-2024-32766 (10.0 critical 🥳) OS command injection vulnerability could allow users to execute commands via a network

QNAP added 3 additional CVEs to a 09 March 2024 advisory: CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. QNAP hid the CVSSv3 scores, which isn't surprising given how disgustingly severe they were. No mention of exploitation.

#QNAP #vulnerability #CVE_2024_27124 #CVE_2024_32764 #CVE_2024_32766

QNAP security advisory: Multiple Vulnerabilities in QTS, QuTS hero, QuTScloud, myQNAPcloud, and myQNAPcloud Link (PWN2OWN 2023)

• CVE-2024-21899 (9.8 critical) improper authentication vulnerability could allow users to compromise the security of the system via a network
• CVE-2024-21900 (6.5 medium) injection vulnerability could allow authenticated users to execute commands via a network
• CVE-2024-21901 (4.7 medium) SQL injection vulnerability could allow authenticated administrators to inject malicious code via a network
• CVE-2024-27124 (7.5 high) OS command injection vulnerability could allow users to execute commands via a network
• CVE-2024-32764 (9.9 critical) missing authentication for critical function vulnerability could allow unprivileged users to gain access to and execute certain functions via a network
• CVE-2024-32766 (10.0 critical 🥳) OS command injection vulnerability could allow users to execute commands via a network

QNAP added 3 additional CVEs to a 09 March 2024 advisory: CVE-2024-27124, CVE-2024-32764 and CVE-2024-32766. QNAP hid the CVSSv3 scores, which isn't surprising given how disgustingly severe they were. No mention of exploitation.

#QNAP #vulnerability #CVE_2024_27124 #CVE_2024_32764 #CVE_2024_32766

Over 1,400 CrushFTP Instances Vulnerable to Exploited Zero-Day https://www.securityweek.com/over-1400-crushftp-instances-vulnerable-to-exploited-zero-day/ #Malware&Threats #Vulnerabilities #CVE20244040 #CrushFTP #ZeroDay

Over 1,400 CrushFTP Instances Vulnerable to Exploited Zero-Day https://www.securityweek.com/over-1400-crushftp-instances-vulnerable-to-exploited-zero-day/ #Malware&Threats #Vulnerabilities #CVE20244040 #CrushFTP #ZeroDay

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

While everyone's freaking out about Cisco, CISA added CrushFTP's actively exploited zero-day CVE-2024-4040 to the Known Exploited Vulnerabilities (KEV) Catalog: 🔗 https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

#zeroday #vulnerability #CVE_2024_4040 #CrushFTP #eitw #activeexploitation #CISA #KnownExploitedVulnerabilitiesCatalog

@h4sh Rapid7 has a much more severe analysis of CVE-2024-4040, the actively exploited CrushFTP zero-day. 🔗 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

Rapid7’s vulnerability research team analyzed CVE-2024-4040 and determined that it is fully unauthenticated and trivially exploitable; successful exploitation allows for not only arbitrary file read as root, but also authentication bypass for administrator account access and full remote code execution. Successful exploitation allows a remote, unauthenticated attacker to access and potentially exfiltrate all files stored on the CrushFTP instance.

Although the vulnerability has been formally described as an arbitrary file read, Rapid7 believes that it can be more accurately categorized as a server-side template injection (SSTI).

#zeroday #vulnerability #CVE_2024_4040 #CrushFTP #eitw #activeexploitation

Okay, other than the vendor's email to their customers I have not seen any proof that the #crushFTP bug is unauthenticated.

Can anyone from IR teams confirm that the exploitation was ever unauthenticated? I just need proof if I am to update the CVSS from 7.7 to like, 8.6

#CVE_2024_4040

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

@campuscodi Kudos to @h4sh for assigning the CVE to the actively exploited CrushFTP zero-day: https://infosec.exchange/@h4sh/112316550866303546

According to his analysis and patch diffing, the CVSSv3 score for CVE-2024-4040 is 7.7 HIGH: Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Did some patch diffing on the new #crushFTP bug, and it does look like the bug has 2 components and at least one of them need some form of authentication to exploit (need creation of something).
After the first stage, the reading of the file outside of VFS sandbox might not need authentication. I am not sure.

#CrushFTP #zeroday #vulnerability #CVE_2024_4040 #eitw #activeexploitation

Shoutout to @h4sh for getting a CVE ID assigned to this actively exploited zero-day CrushFTP vulnerability: CVE-2024-4040 (reported by Simon Garrelou, of Airbus CERT). https://www.cve.org/CVERecord?id=CVE-2024-4040

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

#zeroday #eitw #activeexploitation #CrushFTP #vulnerability #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

@h4sh Rapid7 has a much more severe analysis of CVE-2024-4040, the actively exploited CrushFTP zero-day. 🔗 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

Rapid7’s vulnerability research team analyzed CVE-2024-4040 and determined that it is fully unauthenticated and trivially exploitable; successful exploitation allows for not only arbitrary file read as root, but also authentication bypass for administrator account access and full remote code execution. Successful exploitation allows a remote, unauthenticated attacker to access and potentially exfiltrate all files stored on the CrushFTP instance.

Although the vulnerability has been formally described as an arbitrary file read, Rapid7 believes that it can be more accurately categorized as a server-side template injection (SSTI).

#zeroday #vulnerability #CVE_2024_4040 #CrushFTP #eitw #activeexploitation

Okay, other than the vendor's email to their customers I have not seen any proof that the #crushFTP bug is unauthenticated.

Can anyone from IR teams confirm that the exploitation was ever unauthenticated? I just need proof if I am to update the CVSS from 7.7 to like, 8.6

#CVE_2024_4040

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

@campuscodi Kudos to @h4sh for assigning the CVE to the actively exploited CrushFTP zero-day: https://infosec.exchange/@h4sh/112316550866303546

According to his analysis and patch diffing, the CVSSv3 score for CVE-2024-4040 is 7.7 HIGH: Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Did some patch diffing on the new #crushFTP bug, and it does look like the bug has 2 components and at least one of them need some form of authentication to exploit (need creation of something).
After the first stage, the reading of the file outside of VFS sandbox might not need authentication. I am not sure.

#CrushFTP #zeroday #vulnerability #CVE_2024_4040 #eitw #activeexploitation

Shoutout to @h4sh for getting a CVE ID assigned to this actively exploited zero-day CrushFTP vulnerability: CVE-2024-4040 (reported by Simon Garrelou, of Airbus CERT). https://www.cve.org/CVERecord?id=CVE-2024-4040

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

#zeroday #eitw #activeexploitation #CrushFTP #vulnerability #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

While everyone's freaking out about Cisco, CISA added CrushFTP's actively exploited zero-day CVE-2024-4040 to the Known Exploited Vulnerabilities (KEV) Catalog: 🔗 https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

#zeroday #vulnerability #CVE_2024_4040 #CrushFTP #eitw #activeexploitation #CISA #KnownExploitedVulnerabilitiesCatalog

@h4sh Rapid7 has a much more severe analysis of CVE-2024-4040, the actively exploited CrushFTP zero-day. 🔗 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

Rapid7’s vulnerability research team analyzed CVE-2024-4040 and determined that it is fully unauthenticated and trivially exploitable; successful exploitation allows for not only arbitrary file read as root, but also authentication bypass for administrator account access and full remote code execution. Successful exploitation allows a remote, unauthenticated attacker to access and potentially exfiltrate all files stored on the CrushFTP instance.

Although the vulnerability has been formally described as an arbitrary file read, Rapid7 believes that it can be more accurately categorized as a server-side template injection (SSTI).

#zeroday #vulnerability #CVE_2024_4040 #CrushFTP #eitw #activeexploitation

Okay, other than the vendor's email to their customers I have not seen any proof that the #crushFTP bug is unauthenticated.

Can anyone from IR teams confirm that the exploitation was ever unauthenticated? I just need proof if I am to update the CVSS from 7.7 to like, 8.6

#CVE_2024_4040

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

@campuscodi Kudos to @h4sh for assigning the CVE to the actively exploited CrushFTP zero-day: https://infosec.exchange/@h4sh/112316550866303546

According to his analysis and patch diffing, the CVSSv3 score for CVE-2024-4040 is 7.7 HIGH: Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Did some patch diffing on the new #crushFTP bug, and it does look like the bug has 2 components and at least one of them need some form of authentication to exploit (need creation of something).
After the first stage, the reading of the file outside of VFS sandbox might not need authentication. I am not sure.

#CrushFTP #zeroday #vulnerability #CVE_2024_4040 #eitw #activeexploitation

Shoutout to @h4sh for getting a CVE ID assigned to this actively exploited zero-day CrushFTP vulnerability: CVE-2024-4040 (reported by Simon Garrelou, of Airbus CERT). https://www.cve.org/CVERecord?id=CVE-2024-4040

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

#zeroday #eitw #activeexploitation #CrushFTP #vulnerability #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

@h4sh Rapid7 has a much more severe analysis of CVE-2024-4040, the actively exploited CrushFTP zero-day. 🔗 https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

Rapid7’s vulnerability research team analyzed CVE-2024-4040 and determined that it is fully unauthenticated and trivially exploitable; successful exploitation allows for not only arbitrary file read as root, but also authentication bypass for administrator account access and full remote code execution. Successful exploitation allows a remote, unauthenticated attacker to access and potentially exfiltrate all files stored on the CrushFTP instance.

Although the vulnerability has been formally described as an arbitrary file read, Rapid7 believes that it can be more accurately categorized as a server-side template injection (SSTI).

#zeroday #vulnerability #CVE_2024_4040 #CrushFTP #eitw #activeexploitation

Okay, other than the vendor's email to their customers I have not seen any proof that the #crushFTP bug is unauthenticated.

Can anyone from IR teams confirm that the exploitation was ever unauthenticated? I just need proof if I am to update the CVSS from 7.7 to like, 8.6

#CVE_2024_4040

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

@campuscodi Kudos to @h4sh for assigning the CVE to the actively exploited CrushFTP zero-day: https://infosec.exchange/@h4sh/112316550866303546

According to his analysis and patch diffing, the CVSSv3 score for CVE-2024-4040 is 7.7 HIGH: Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Did some patch diffing on the new #crushFTP bug, and it does look like the bug has 2 components and at least one of them need some form of authentication to exploit (need creation of something).
After the first stage, the reading of the file outside of VFS sandbox might not need authentication. I am not sure.

#CrushFTP #zeroday #vulnerability #CVE_2024_4040 #eitw #activeexploitation

Shoutout to @h4sh for getting a CVE ID assigned to this actively exploited zero-day CrushFTP vulnerability: CVE-2024-4040 (reported by Simon Garrelou, of Airbus CERT). https://www.cve.org/CVERecord?id=CVE-2024-4040

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

#zeroday #eitw #activeexploitation #CrushFTP #vulnerability #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

Over 1,400 CrushFTP Instances Vulnerable to Exploited Zero-Day https://www.securityweek.com/over-1400-crushftp-instances-vulnerable-to-exploited-zero-day/ #Malware&Threats #Vulnerabilities #CVE20244040 #CrushFTP #ZeroDay

Over 1,400 CrushFTP Instances Vulnerable to Exploited Zero-Day https://www.securityweek.com/over-1400-crushftp-instances-vulnerable-to-exploited-zero-day/ #Malware&Threats #Vulnerabilities #CVE20244040 #CrushFTP #ZeroDay

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

Here's a #nuclei template to detect potentially unpatched #CrushFTP 10.x servers against CVE-2024-4040.

Note that the templates do NOT exploit the vuln and are not remotely related to a POC. Attackers will likely find these useless because they are.

https://github.com/directcyber/checkers/blob/main/nuclei-templates/CVE-2024-4040-crushftp-potentially-unpatched.yaml

#CVE20244040 #CVE_2024_4040

I bring you CVE-2024-4040: VFS Sandbox Escape in #CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

https://www.cve.org/CVERecord?id=CVE-2024-4040

If anyone disagrees with our CVSS analysis, please let me know & bring proof

#CVE20244040 #CVE_2024_4040

CrushFTP VFS Sandbox Escape Vulnerability (CVE-2024-4040) https://fortiguard.fortinet.com/threat-signal-report/5431

Rapid7 now has a full technical analysis of #CrushFTP CVE-2024-4040 available in AttackerKB (with many thanks to @fuzz for the great work!) https://attackerkb.com/topics/20oYjlmfXa/cve-2024-4040/rapid7-analysis

@h4sh I'm unfamiliar with the CVE process. NVD's information hasn't updated yet, which I assume eventually updates from cve.org. Do you know when NVD's information will reflect cve.org's? @todb

• https://www.cve.org/CVERecord?id=CVE-2024-4040
• https://nvd.nist.gov/vuln/detail/CVE-2024-4040#VulnChangeHistorySection

Due to new information, CVE-2024-4040 is now an unauthenticated remote code execution via template injection (CVSS 9.8). Multiple sources of new information have confirmed this. The CVE record has been updated.

https://www.cve.org/CVERecord?id=CVE-2024-4040

> A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Rapid7 researcher @fuzz analyzed #CrushFTP CVE-2024-4040 and found that it's not only exploitable for arbitrary file read as root, but also authentication bypass for admin access and full RCE. Patch immediately. https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

Exploit from airbus-cert is out for #crushFTP CVE-2024-4040

Expect more in the wild exploitation in the coming days.. https://infosec.exchange/@wvu/112320211100310152

h/t @JohnHammond https://github.com/airbus-cert/CVE-2024-4040

CrushFTP zero-day exploited by attackers, upgrade immediately! (CVE-2024-4040) https://www.helpnetsecurity.com/2024/04/23/cve-2024-4040/ #CrowdStrike #enterprise #Don'tmiss #Hotstuff #CrushFTP #exploit #Censys #News #CVE #FTP

The CrushFTP zero-day is now CVE-2024-4040

https://nvd.nist.gov/vuln/detail/CVE-2024-4040

Rapid7 now has a full technical analysis of #CrushFTP CVE-2024-4040 available in AttackerKB (with many thanks to @fuzz for the great work!) https://attackerkb.com/topics/20oYjlmfXa/cve-2024-4040/rapid7-analysis

@h4sh I'm unfamiliar with the CVE process. NVD's information hasn't updated yet, which I assume eventually updates from cve.org. Do you know when NVD's information will reflect cve.org's? @todb

• https://www.cve.org/CVERecord?id=CVE-2024-4040
• https://nvd.nist.gov/vuln/detail/CVE-2024-4040#VulnChangeHistorySection

Due to new information, CVE-2024-4040 is now an unauthenticated remote code execution via template injection (CVSS 9.8). Multiple sources of new information have confirmed this. The CVE record has been updated.

https://www.cve.org/CVERecord?id=CVE-2024-4040

> A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows unauthenticated remote attackers to read files from the filesystem outside of the VFS Sandbox, bypass authentication to gain administrative access, and perform remote code execution on the server.

Rapid7 researcher @fuzz analyzed #CrushFTP CVE-2024-4040 and found that it's not only exploitable for arbitrary file read as root, but also authentication bypass for admin access and full RCE. Patch immediately. https://www.rapid7.com/blog/post/2024/04/23/etr-unauthenticated-crushftp-zero-day-enables-complete-server-compromise/

Exploit from airbus-cert is out for #crushFTP CVE-2024-4040

Expect more in the wild exploitation in the coming days.. https://infosec.exchange/@wvu/112320211100310152

h/t @JohnHammond https://github.com/airbus-cert/CVE-2024-4040

The CrushFTP zero-day is now CVE-2024-4040

https://nvd.nist.gov/vuln/detail/CVE-2024-4040

The hubbub about Cisco is winding down, but in case you are handling an active security incident, Computer Incident Response Center Luxembourg (CIRCL) recommended users of Cisco ASA equipment follow the Cisco ASA Forensic Investigation Procedures for First Responders.
This document was created 19 August 2019 and revised 3 times (latest 25 January 2024) by the original author, so it is certainly reliable.

It outlines a number of commands that can be run to gather evidence for an investigation along with the respective output that should be collected upon running these commands. This document also provides information on how to perform integrity checks on an ASA’s system images, and includes a procedure for collecting a core file/memory dump from an ASA device.

#Cisco #CVE_2024_20353 #CVE_2024_20359 #activeexploitation #IR #DFIR #eitw

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Australian Cyber Security Centre (ACSC) of Australian Signals Directorate (ASD) issued a cybersecurity alert 🔗 Exploitation of vulnerabilities affecting Cisco firewall platforms. The important points are that they are aware of activity impacting Cisco ASA devices in Australia and can confirm that some Cisco ASA devices in Australia have been compromised. They refer to the jointly co-authored advisory hosted on CCCS's website: Cyber Activity Impacting CISCO ASA VPNs

#Cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356 #CISA #KnownExploitedVulnerabilitiesCatalog #KEV

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

I take back everything bad I said about NCSC-UK yesterday. They released lengthy malware analysis reports on both malware:

• Line Runner (PDF)
• Line Dancer (PDF)

cc: @todb @campuscodi @mttaggart @DaveMWilburn

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The Canadian Centre for Cyber Security CCCS has a security advisory for the Cisco zero-days and exploitation. It includes backgrounddetails from CCCS's perspective, artifact information about the LINE RUNNER and LINE DANCER malware, indicators of compromise, and recommanded actions: 🔗
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The #Cisco vulns today smack a little of the Barracuda ones last year.

I really hope we don't end at "Toss these ASAs into a volcano."

#CVE_2024_20353 #CVE_2024_20359

@todb @briankrebs @campuscodi @jwarminsky @jgreig @mttaggart

HOT OFF THE PRESS!! CISA adds CVE-2024-202353 and CVE-2024-202359 to the Known Exploited Vulnerabilities (KEV) Catalog. 🔗 https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

See original toot above for information on the Cisco exploited zero-days.

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #CISA #KnownExploitedVulnerabilitiesCatalog

Wake up babe, new Cisco actively exploited zero days just dropped:

• CVE-2024-20353 (8.6 high) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
• CVE-2024-20359 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability

Cisco has confirmed that this vulnerability has been exploited. Cisco strongly recommends that customers upgrade to fixed software to resolve this vulnerability. Customers are also strongly encouraged to monitor system logs for indicators of undocumented configuration changes, unscheduled reboots, and any anomalous credential activity.

See official Cisco Event Response: Attacks Against Cisco Firewall Platforms h/t @ciaranmak

See related Cisco Talos Intelligence blog post ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices for indicators of compromise and additional info h/t @mttaggart

Both CVEs are added to the Known Exploited Vulnerabilities (KEV) Catalog!! https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

EDIT 1510 EST: The Canadian Centre for Cyber Security has a security advisory with additional indicators of compromise: https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

EDIT 1640 ET: NCSC-UK released specific malware analysis reports for:

• Line Runner (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-runner.pdf
• Line Dancer (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf

cc: @todb @briankrebs @campuscodi @jwarminsky @jgreig

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #KnownExploitedVulnerabilitiesCatalog #CISA #UAT4356 #threatintel #IOC

The hubbub about Cisco is winding down, but in case you are handling an active security incident, Computer Incident Response Center Luxembourg (CIRCL) recommended users of Cisco ASA equipment follow the Cisco ASA Forensic Investigation Procedures for First Responders.
This document was created 19 August 2019 and revised 3 times (latest 25 January 2024) by the original author, so it is certainly reliable.

It outlines a number of commands that can be run to gather evidence for an investigation along with the respective output that should be collected upon running these commands. This document also provides information on how to perform integrity checks on an ASA’s system images, and includes a procedure for collecting a core file/memory dump from an ASA device.

#Cisco #CVE_2024_20353 #CVE_2024_20359 #activeexploitation #IR #DFIR #eitw

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Australian Cyber Security Centre (ACSC) of Australian Signals Directorate (ASD) issued a cybersecurity alert 🔗 Exploitation of vulnerabilities affecting Cisco firewall platforms. The important points are that they are aware of activity impacting Cisco ASA devices in Australia and can confirm that some Cisco ASA devices in Australia have been compromised. They refer to the jointly co-authored advisory hosted on CCCS's website: Cyber Activity Impacting CISCO ASA VPNs

#Cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356 #CISA #KnownExploitedVulnerabilitiesCatalog #KEV

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

I take back everything bad I said about NCSC-UK yesterday. They released lengthy malware analysis reports on both malware:

• Line Runner (PDF)
• Line Dancer (PDF)

cc: @todb @campuscodi @mttaggart @DaveMWilburn

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The Canadian Centre for Cyber Security CCCS has a security advisory for the Cisco zero-days and exploitation. It includes backgrounddetails from CCCS's perspective, artifact information about the LINE RUNNER and LINE DANCER malware, indicators of compromise, and recommanded actions: 🔗
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The #Cisco vulns today smack a little of the Barracuda ones last year.

I really hope we don't end at "Toss these ASAs into a volcano."

#CVE_2024_20353 #CVE_2024_20359

@todb @briankrebs @campuscodi @jwarminsky @jgreig @mttaggart

HOT OFF THE PRESS!! CISA adds CVE-2024-202353 and CVE-2024-202359 to the Known Exploited Vulnerabilities (KEV) Catalog. 🔗 https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

See original toot above for information on the Cisco exploited zero-days.

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #CISA #KnownExploitedVulnerabilitiesCatalog

Wake up babe, new Cisco actively exploited zero days just dropped:

• CVE-2024-20353 (8.6 high) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
• CVE-2024-20359 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability

Cisco has confirmed that this vulnerability has been exploited. Cisco strongly recommends that customers upgrade to fixed software to resolve this vulnerability. Customers are also strongly encouraged to monitor system logs for indicators of undocumented configuration changes, unscheduled reboots, and any anomalous credential activity.

See official Cisco Event Response: Attacks Against Cisco Firewall Platforms h/t @ciaranmak

See related Cisco Talos Intelligence blog post ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices for indicators of compromise and additional info h/t @mttaggart

Both CVEs are added to the Known Exploited Vulnerabilities (KEV) Catalog!! https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

EDIT 1510 EST: The Canadian Centre for Cyber Security has a security advisory with additional indicators of compromise: https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

EDIT 1640 ET: NCSC-UK released specific malware analysis reports for:

• Line Runner (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-runner.pdf
• Line Dancer (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf

cc: @todb @briankrebs @campuscodi @jwarminsky @jgreig

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #KnownExploitedVulnerabilitiesCatalog #CISA #UAT4356 #threatintel #IOC

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

The hubbub about Cisco is winding down, but in case you are handling an active security incident, Computer Incident Response Center Luxembourg (CIRCL) recommended users of Cisco ASA equipment follow the Cisco ASA Forensic Investigation Procedures for First Responders.
This document was created 19 August 2019 and revised 3 times (latest 25 January 2024) by the original author, so it is certainly reliable.

It outlines a number of commands that can be run to gather evidence for an investigation along with the respective output that should be collected upon running these commands. This document also provides information on how to perform integrity checks on an ASA’s system images, and includes a procedure for collecting a core file/memory dump from an ASA device.

#Cisco #CVE_2024_20353 #CVE_2024_20359 #activeexploitation #IR #DFIR #eitw

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Australian Cyber Security Centre (ACSC) of Australian Signals Directorate (ASD) issued a cybersecurity alert 🔗 Exploitation of vulnerabilities affecting Cisco firewall platforms. The important points are that they are aware of activity impacting Cisco ASA devices in Australia and can confirm that some Cisco ASA devices in Australia have been compromised. They refer to the jointly co-authored advisory hosted on CCCS's website: Cyber Activity Impacting CISCO ASA VPNs

#Cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356 #CISA #KnownExploitedVulnerabilitiesCatalog #KEV

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

I take back everything bad I said about NCSC-UK yesterday. They released lengthy malware analysis reports on both malware:

• Line Runner (PDF)
• Line Dancer (PDF)

cc: @todb @campuscodi @mttaggart @DaveMWilburn

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The Canadian Centre for Cyber Security CCCS has a security advisory for the Cisco zero-days and exploitation. It includes backgrounddetails from CCCS's perspective, artifact information about the LINE RUNNER and LINE DANCER malware, indicators of compromise, and recommanded actions: 🔗
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The #Cisco vulns today smack a little of the Barracuda ones last year.

I really hope we don't end at "Toss these ASAs into a volcano."

#CVE_2024_20353 #CVE_2024_20359

@todb @briankrebs @campuscodi @jwarminsky @jgreig @mttaggart

HOT OFF THE PRESS!! CISA adds CVE-2024-202353 and CVE-2024-202359 to the Known Exploited Vulnerabilities (KEV) Catalog. 🔗 https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

See original toot above for information on the Cisco exploited zero-days.

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #CISA #KnownExploitedVulnerabilitiesCatalog

Wake up babe, new Cisco actively exploited zero days just dropped:

• CVE-2024-20353 (8.6 high) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
• CVE-2024-20359 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability

Cisco has confirmed that this vulnerability has been exploited. Cisco strongly recommends that customers upgrade to fixed software to resolve this vulnerability. Customers are also strongly encouraged to monitor system logs for indicators of undocumented configuration changes, unscheduled reboots, and any anomalous credential activity.

See official Cisco Event Response: Attacks Against Cisco Firewall Platforms h/t @ciaranmak

See related Cisco Talos Intelligence blog post ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices for indicators of compromise and additional info h/t @mttaggart

Both CVEs are added to the Known Exploited Vulnerabilities (KEV) Catalog!! https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

EDIT 1510 EST: The Canadian Centre for Cyber Security has a security advisory with additional indicators of compromise: https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

EDIT 1640 ET: NCSC-UK released specific malware analysis reports for:

• Line Runner (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-runner.pdf
• Line Dancer (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf

cc: @todb @briankrebs @campuscodi @jwarminsky @jgreig

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #KnownExploitedVulnerabilitiesCatalog #CISA #UAT4356 #threatintel #IOC

The hubbub about Cisco is winding down, but in case you are handling an active security incident, Computer Incident Response Center Luxembourg (CIRCL) recommended users of Cisco ASA equipment follow the Cisco ASA Forensic Investigation Procedures for First Responders.
This document was created 19 August 2019 and revised 3 times (latest 25 January 2024) by the original author, so it is certainly reliable.

It outlines a number of commands that can be run to gather evidence for an investigation along with the respective output that should be collected upon running these commands. This document also provides information on how to perform integrity checks on an ASA’s system images, and includes a procedure for collecting a core file/memory dump from an ASA device.

#Cisco #CVE_2024_20353 #CVE_2024_20359 #activeexploitation #IR #DFIR #eitw

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Australian Cyber Security Centre (ACSC) of Australian Signals Directorate (ASD) issued a cybersecurity alert 🔗 Exploitation of vulnerabilities affecting Cisco firewall platforms. The important points are that they are aware of activity impacting Cisco ASA devices in Australia and can confirm that some Cisco ASA devices in Australia have been compromised. They refer to the jointly co-authored advisory hosted on CCCS's website: Cyber Activity Impacting CISCO ASA VPNs

#Cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356 #CISA #KnownExploitedVulnerabilitiesCatalog #KEV

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

I take back everything bad I said about NCSC-UK yesterday. They released lengthy malware analysis reports on both malware:

• Line Runner (PDF)
• Line Dancer (PDF)

cc: @todb @campuscodi @mttaggart @DaveMWilburn

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The Canadian Centre for Cyber Security CCCS has a security advisory for the Cisco zero-days and exploitation. It includes backgrounddetails from CCCS's perspective, artifact information about the LINE RUNNER and LINE DANCER malware, indicators of compromise, and recommanded actions: 🔗
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The #Cisco vulns today smack a little of the Barracuda ones last year.

I really hope we don't end at "Toss these ASAs into a volcano."

#CVE_2024_20353 #CVE_2024_20359

@todb @briankrebs @campuscodi @jwarminsky @jgreig @mttaggart

HOT OFF THE PRESS!! CISA adds CVE-2024-202353 and CVE-2024-202359 to the Known Exploited Vulnerabilities (KEV) Catalog. 🔗 https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

See original toot above for information on the Cisco exploited zero-days.

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #CISA #KnownExploitedVulnerabilitiesCatalog

Wake up babe, new Cisco actively exploited zero days just dropped:

• CVE-2024-20353 (8.6 high) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
• CVE-2024-20359 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability

Cisco has confirmed that this vulnerability has been exploited. Cisco strongly recommends that customers upgrade to fixed software to resolve this vulnerability. Customers are also strongly encouraged to monitor system logs for indicators of undocumented configuration changes, unscheduled reboots, and any anomalous credential activity.

See official Cisco Event Response: Attacks Against Cisco Firewall Platforms h/t @ciaranmak

See related Cisco Talos Intelligence blog post ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices for indicators of compromise and additional info h/t @mttaggart

Both CVEs are added to the Known Exploited Vulnerabilities (KEV) Catalog!! https://www.cisa.gov/news-events/alerts/2024/04/24/cisa-adds-three-known-exploited-vulnerabilities-catalog

EDIT 1510 EST: The Canadian Centre for Cyber Security has a security advisory with additional indicators of compromise: https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

EDIT 1640 ET: NCSC-UK released specific malware analysis reports for:

• Line Runner (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-runner.pdf
• Line Dancer (PDF) https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/line/ncsc-tip-line-dancer.pdf

cc: @todb @briankrebs @campuscodi @jwarminsky @jgreig

#Cisco #zeroday #vulnerability #activeexploitation #eitw #CVE_2024_20353 #CVE_2024_20359 #KEV #KnownExploitedVulnerabilitiesCatalog #CISA #UAT4356 #threatintel #IOC

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Urgent Remediation Advised for Cisco ASA and FTD Vulnerabilities

Date: 24 April 2024
CVE: [[CVE-2024-20353]], [[CVE-2024-20358]], [[CVE-2024-20359]]
Vulnerability Type: Denial of Service and Privilege Escalation
CWE: [[CWE-20]], [[CWE-264]]
Sources: NCSC's official release Cisco's security advisory

Issue Summary

The UK's National Cyber Security Centre (NCSC) has reported active exploitation of critical vulnerabilities in Cisco devices running Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. The vulnerabilities allow unauthenticated denial of service and authenticated command execution with elevated privileges. No specific configuration is required. These vulnerabilities are rumored to be abused by state backed threat actors for espionage.

Technical Key Findings

CVE-2024-20353 involves the ASA and FTD's management and VPN web servers, enabling remote attackers to cause disruptive reloads. CVE-2024-20358 and CVE-2024-20359 require administrative access, allowing execution of arbitrary commands or code under root privileges.

Vulnerable Products

• Cisco Adaptive Security Appliance (ASA) Software
• Cisco Firepower Threat Defense (FTD) Software

Impact Assessment

Successful exploitation could lead to service disruption and unauthorized administrative access to network devices, potentially leading to further lateral movement within networks. Cisco is aware that CVE-2024-20353 and CVE-2024-20359 are being actively exploited.

Patches or Workaround

Cisco has released free software updates that address the vulnerability described in this advisory.

Tags

#Cisco #CVE202420353 #CVE202420358 #CVE202420359 #DenialOfService #PrivilegeEscalation #CyberSecurity

Multiple government agencies has published an advisory on an ongoing APT campaign targeting Cisco ASA / FTD devices using post-auth RCE bug CVE-2024-20359 and CVE-2024-20358.

They don't know how the attackers initially got in.

Important note from the research published by Cisco Talos calling the APT operation* "ArcaneDoor":

> We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date. Our investigation is ongoing, and we will provide updates, if necessary, in the security advisories or on this blog.

https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

ArcaneDoor Attack (CVE-2024-20353 and CVE-2024-20359) https://fortiguard.fortinet.com/threat-signal-report/5429

Hackers backdoored Cisco ASA devices via two zero-days (CVE-2024-20353, CVE-2024-20359) https://www.helpnetsecurity.com/2024/04/24/cve-2024-20353-cve-2024-20359/ #government-backedattacks #securityupdate #Don'tmiss #Microsoft #Hotstuff #firewall #0-day #Cisco #Lumen #News #CISA #NCSC

@GossiTheDog Here are the CVE security advisories:

• CVE-2024-20353 (8.6 high) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
• CVE-2024-20359 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability

🚨🚨 two zero days in Cisco ASA AnyConnect under exploitation since last year

CVE-2024-20353 and CVE-2024-20359

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#threatintel #ArcaneDoor

Multiple government agencies has published an advisory on an ongoing APT campaign targeting Cisco ASA / FTD devices using post-auth RCE bug CVE-2024-20359 and CVE-2024-20358.

They don't know how the attackers initially got in.

Important note from the research published by Cisco Talos calling the APT operation* "ArcaneDoor":

> We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date. Our investigation is ongoing, and we will provide updates, if necessary, in the security advisories or on this blog.

https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

@GossiTheDog Here are the CVE security advisories:

• CVE-2024-20353 (8.6 high) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Web Services Denial of Service Vulnerability
• CVE-2024-20359 (6.0 medium) Cisco Adaptive Security Appliance and Firepower Threat Defense Software Persistent Local Code Execution Vulnerability

🚨🚨 two zero days in Cisco ASA AnyConnect under exploitation since last year

CVE-2024-20353 and CVE-2024-20359

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#threatintel #ArcaneDoor

The hubbub about Cisco is winding down, but in case you are handling an active security incident, Computer Incident Response Center Luxembourg (CIRCL) recommended users of Cisco ASA equipment follow the Cisco ASA Forensic Investigation Procedures for First Responders.
This document was created 19 August 2019 and revised 3 times (latest 25 January 2024) by the original author, so it is certainly reliable.

It outlines a number of commands that can be run to gather evidence for an investigation along with the respective output that should be collected upon running these commands. This document also provides information on how to perform integrity checks on an ASA’s system images, and includes a procedure for collecting a core file/memory dump from an ASA device.

#Cisco #CVE_2024_20353 #CVE_2024_20359 #activeexploitation #IR #DFIR #eitw

The Canadian Centre for Cyber Security has issued a detailed security advisory regarding the "LINE DANCER" & "LINE RUNNER" attacks against Cisco ASA devices by what it believes are nation-state sponsored malicious actors.

As usual, if you or your organization runs Cisco ASAs, time to patch to mitigate these vulnerabilities.

www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#infosec #cybersecurity #LINEDANCER #LINERUNNER #ARCANEDOOR #Cisco #CiscoASA #SecurityAdvisory #CVE_2024_20359 #CVE_2024_20353

Just a reminder that while we are up to 3 CVEs for the #Cisco #ArcaneDoor attack, we still don't know what the initial access to these devices was.

If I were a very strategic purchaser, I'd be thinking about what it would look like to replace any Cisco gear on my perimeter. Just in case.

blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

#CVE_2024_20353 #CVE_2024_20358 #CVE_2024_20359

Australian Cyber Security Centre (ACSC) of Australian Signals Directorate (ASD) issued a cybersecurity alert 🔗 Exploitation of vulnerabilities affecting Cisco firewall platforms. The important points are that they are aware of activity impacting Cisco ASA devices in Australia and can confirm that some Cisco ASA devices in Australia have been compromised. They refer to the jointly co-authored advisory hosted on CCCS's website: Cyber Activity Impacting CISCO ASA VPNs

#Cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356 #CISA #KnownExploitedVulnerabilitiesCatalog #KEV

So, if you think you've maybe got #ArcaneDoor / #LineDancer issues on your ASA (discovery methods here: https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/), first things first:

DO NOT REBOOT OR CRASH DUMP YOUR DEVICE (sorry for shouting)

"When following these procedures first responders should NOT attempt to collect a core dump (Step 5) or reboot the device if they believe that the device has been compromised, based on the lina memory region output."

This thing runs in (hard to reach) memory, and hooks smartly, so it will be gone and your collection will have failed.

What you should do is (I'll quote):

1. Log in to the suspect device CLI. Note: On devices that are running Cisco FTD Software, change into the Cisco ASA CLI using the system support diagnostic-cli command.
2. Use the enable command to change into privileged EXEC mode.Note: On devices that are running Cisco FTD Software, the enable password is blank.
3. Collect the outputs of the following commands:
   • show version
   • verify /SHA-512 system:memory/text
   • debug menu memory 8
4. Open a case with the Cisco Technical Assistance Center (TAC, https://www.cisco.com/c/en/us/support/index.html). In the case, reference the keyword ArcaneDoor and upload the data that was collected in Step 3.

Secondly, although you should patch (after establishing you have not been compromised), the two patches mentioned won't protect you from the getting reinfected.

I will repeat (without shouting this time):

Patching is not a fix!

"We have not determined the initial access vector used in this campaign. We have not identified evidence of pre-authentication exploitation to date."

There did pop up a third CVE (#CVE_2024_20358) in between the Talos publication and the CISCO advisory page (https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response), but it is also local (not "network"), so I guess that won't safe anyone from reinfection either. But that's just me guessing.

#CVE_2024_20359 #CVE_2024_20353 #infosec #cybersecurity

Final question for anyone still reading: why the debug menu memory 8? What does it do?

I take back everything bad I said about NCSC-UK yesterday. They released lengthy malware analysis reports on both malware:

• Line Runner (PDF)
• Line Dancer (PDF)

cc: @todb @campuscodi @mttaggart @DaveMWilburn

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The Canadian Centre for Cyber Security CCCS has a security advisory for the Cisco zero-days and exploitation. It includes backgrounddetails from CCCS's perspective, artifact information about the LINE RUNNER and LINE DANCER malware, indicators of compromise, and recommanded actions: 🔗
https://www.cyber.gc.ca/en/news-events/cyber-activity-impacting-cisco-asa-vpns

#cisco #ASA #zeroday #vulnerability #eitw #activeexploitation #CVE_2024_20353 #CVE_2024_20359 #China #cyberespionage #threatintel #IOC #UAT4356

The #Cisco vulns today smack a little of the Barracuda ones last year.

I really hope we don't end at "Toss these ASAs into a volcano."

#CVE_2024_20353 #CVE_2024_20359

@todb @briankrebs @campuscodi @jwarminsky @jgreig @mttaggart