SysAdmin 24x7

➡️Netgate is offering COVID-19 aid for pfSense software users. https://info.netgate.com/covid

pfSense 2.4.5 New Features and Changes pfSense® software version 2.4.5 contains a variety of bug fixes and maintenance updates. https://docs.netgate.com/pfsense/en/latest/releases/2-4-5-new-features-and-changes.html

Vulnerabilidad de escalada de privilegios en WebSphere Application Server de IBM Fecha de publicación: 26/03/2020 Importancia: 4 - Alta Recursos afectados: WebSphere Application Server, versiones 7.0, 8.0, 8.5 y 9.0. Descripción: IBM ha publicado una vulnerabilidad en WebSphere Application Server que podría permitir a un atacante la escalada de privilegios. Solución: Aplicar las siguientes actualizaciones en función de la versión: Desde la V9.0.0.0 hasta la 9.0.5.3: Actualizar según los requisitos del interim fix y luego aplicar el Interim Fix PH21511, o aplicar el Fix Pack 9.0.5.4 o posterior (disponible en el segundo cuatrimestre de 2020). Desde la V8.5.0.0 hasta la 8.5.5.17: Actualizar según los requisitos del interim fix y luego aplicar el Interim Fix PH21511, o aplicar el Fix Pack 8.5.5.18 o posterior (disponible en el tercer cuatrimestre de 2020). Desde la V8.0.0.0 hasta 8.0.0.15: Actualizar a la 8.0.0.15 y luego aplicar el Interim Fix PH21511. Desde la V7.0.0.0 hasta la 7.0.0.45: Actualizar a la 7.0.0.45 y luego aplicar el Interim Fix PH21511. Detalle: Una vulnerabilidad en IBM WebSphere Application Server podría permitir a un atacante la escalada de privilegios cuando se utiliza la autenticación basada en tokens en una solicitud de administración sobre el conector SOAP. Se ha reservado el identificador CVE-2020-4276 para esta vulnerabilidad. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-escalada-privilegios-websphere-application-server

Múltiples vulnerabilidades en Jenkins Fecha de publicación: 26/03/2020 Importancia: 4 - Alta Recursos afectados: Jenkins LTS, versión 2.204.5 y anteriores; Jenkins weekly, versión 2.227 y anteriores. Descripción: Jenkins ha detectado 4 vulnerabilidades, una de criticidad alta y 3 medias, que afectan a su core y permitirían realizar ataques de tipo CSRF (Cross-Site Request Forgery) y XSS (Cross-Site Scripting) persistente. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-jenkins-8

Vulnerabilidades de inyección SQL en phpMyAdmin Fecha de publicación: 24/03/2020 Importancia: 4 - Alta Recursos afectados:  phpMyAdmin, versiones 4.9.x anteriores a 4.9.5, y versiones 5.0.x anteriores a 5.0.2. Descripción:  Los investigadores hoangn144_VCS, bluebird y Yutaka WATANABE, han reportado 3 vulnerabilidades, 2 de severidad alta y una media, todas de inyección SQL. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidades-inyeccion-sql-phpmyadmin

Vulnerabilidades de ejecución remota de código en Microsoft Windows Fecha de publicación: 24/03/2020 Importancia: 5 - Crítica Descripción:  Microsoft ha detectado dos vulnerabilidades de severidad crítica. Un atacante remoto podría realizar una ejecución código en el sistema. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidades-ejecucion-remota-codigo-microsoft-windows

Critical RCE Bug Affects Millions of OpenWrt-based Network Devices A cybersecurity researcher today disclosed technical details and proof-of-concept of a critical remote code execution vulnerability affecting OpenWrt, a widely used Linux-based operating system for routers, residential gateways, and other embedded devices that route network traffic. https://thehackernews.com/2020/03/openwrt-rce-vulnerability.html

TeamViewer Stops Commercial Use Checks in Coronavirus-Affected Regions TeamViewer has stated that they will stop performing checks for commercial use of their remote control product in regions heavily affected by the Coronavirus. https://www.bleepingcomputer.com/news/software/teamviewer-stops-commercial-use-checks-in-coronavirus-affected-regions/

HPE Warns of New Bug That Kills SSD Drives After 40,000 Hours Hewlett Packard Enterprise (HPE) is once again warning its customers that certain Serial-Attached SCSI solid-state drives will fail after 40,000 hours of operation, unless a critical patch is applied. https://www.bleepingcomputer.com/news/security/hpe-warns-of-new-bug-that-kills-ssd-drives-after-40-000-hours/

ADV200006 | Type 1 Font Parsing Remote Code Execution Vulnerability Security Advisory Published: 03/23/2020 Microsoft is aware of limited targeted attacks that could leverage un-patched vulnerabilities in the Adobe Type Manager Library, and is providing the following guidance to help reduce customer risk until the security update is released. Two remote code execution vulnerabilities exist in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format. There are multiple ways an attacker could exploit the vulnerability, such as convincing a user to open a specially crafted document or viewing it in the Windows Preview pane. https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV200006

Redireccionamiento abierto en IBM Jazz for Service Management Fecha de publicación: 23/03/2020 Importancia: Alta Recursos afectados IBM Jazz for Service Management (JazzSM), versión 1.1.3. Descripción IBM Jazz for Service Management contiene una vulnerabilidad, de severidad alta, de tipo redireccionamiento abierto. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/redireccionamiento-abierto-ibm-jazz-service-management

Top 10 security items to improve in your AWS account https://aws.amazon.com/es/blogs/security/top-10-security-items-to-improve-in-your-aws-account/

Mukashi, la nueva variante de Mirai que explota los NAS Zyxel https://unaaldia.hispasec.com/2020/03/mukashi-la-nueva-variante-de-mirai-que-explota-los-nas-zyxel.html

Múltiples botnets utilizaron 0-days en dispositivos de grabación de vídeo digital LILIN https://unaaldia.hispasec.com/2020/03/multiples-botnets-utilizaron-0-days-en-dispositivos-de-grabacion-de-video-digital-lilin.html

¡LA SANIDAD PÚBLICA TE NECESITA! Si tienes una impresora 3D echa un vistazo a los grupos/canales y si sabes alguien que la tenga reenvíale este mensaje. Más info Mantener los grupos tranquilos, son de trabajo

Otro proyecto similar https://foro.coronavirusmakers.org/index.php?p=/

Creado por ResistenciaTeam, un equipo de trabajo que ha diseñado los primeros respiradores autónomos Open, basados en el sistema Jackson Rees. Para hacer con impresora 3D Quien pueda que contacte con ellos. Es en España, puede servir para otros países. https://twitter.com/ReesistenciaT/status/1239903755463688198?s=19

CVE-2020-0881 | GDI+ Remote Code Execution Vulnerability A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. There are multiple ways an attacker could exploit the vulnerability: In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerability and then convince users to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to open an email attachment or click a link in an email or instant message. In a file-sharing attack scenario, an attacker could provide a specially crafted document file that is designed to exploit the vulnerability, and then convince users to open the document file. The security update addresses the vulnerability by correcting the way that the Windows GDI handles objects in the memory. https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0881

Google Releases Security Updates for Chrome Google has released Chrome version 80.0.3987.149 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Chrome Release and apply the necessary updates. https://www.us-cert.gov/ncas/current-activity/2020/03/19/google-releases-security-updates-chrome

Drupal Releases Security Updates Drupal has released security updates to address vulnerabilities affecting Drupal 8.7.x and 8.8.x. An attacker could exploit these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Drupal security release and apply the necessary updates or mitigations. https://www.us-cert.gov/ncas/current-activity/2020/03/19/drupal-releases-security-updates