SysAdmin 24x7

Actualizaciones críticas en Oracle (enero 2020) Fecha de publicación: 15/01/2020 Importancia: 5 - Crítica Descripción: Oracle ha publicado una actualización crítica con parches para corregir vulnerabilidades que afectan a múltiples productos. Solución: Aplicar los parches correspondientes según los productos afectados. La información para descargar las actualizaciones puede obtenerse del boletín de seguridad publicado por Oracle. Detalle: Esta actualización resuelve un total de 255 vulnerabilidades (con 334 parches), algunas de las cuales son críticas. El detalle de las vulnerabilidades resueltas se puede consultar en el enlace de Oracle de la sección de Referencias. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/actualizaciones-criticas-oracle-enero-2020

Vulnerabilidad en VMware Tools Fecha de publicación: 15/01/2020 Importancia: 4 - Alta Recursos afectados: VMware Tools, versión 10.x.y para Windows. Descripción: Se ha publicado una vulnerabilidad de criticidad alta. Un atacante local podría realizar una escalada de privilegios en el sistema. Solución: Se recomienda actualizar a VMware Tools a la versión 11.0.0 y posteriores. Si no es posible actualizar, se puede prevenir su explotación siguiendo estas indicaciones de VMware. Detalle: La operación de reparación de VMware Tools para Windows tiene una condición de carrera. Un atacante, en la máquina virtual invitada, podría escalar privilegios en una máquina virtual de Windows. Se ha reservado el identificador CVE-2020-3941 para esta vulnerabilidad. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-vmware-tools

Using ATT&CK for Cyber Threat Intelligence Training https://attack.mitre.org/resources/training/cti

Intel Releases Security Updates Intel has released security updates to address vulnerabilities in multiple products. An authenticated attacker with local access could exploit some of these vulnerabilities to gain escalation of privileges. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Intel advisories and apply the necessary updates: SNMP Subagent Stand-Alone Advisory for Windows INTEL-SA-0030 Chipset Device Software Advisory INTEL-SA-00306 RWC 3 for Windows Advisory INTEL-SA-00308 Processor Graphics Advisory INTEL-SA-00314 VTune Amplifier for Windows Advisory INTEL-SA-00325 DAAL Advisory INTEL-SA-00332 https://www.us-cert.gov/ncas/current-activity/2020/01/14/intel-releases-security-updates

NSA's First Public Vulnerability Disclosure: An Effort to Build Trust The U.S. National Security Agency (NSA) started a new chapter after discovering and reporting to Microsoft a vulnerability tracked as CVE-2020-0601 and impacting Windows 10 and Windows Server systems. https://www.bleepingcomputer.com/news/security/nsas-first-public-vulnerability-disclosure-an-effort-to-build-trust/

Alert (AA20-014A) Critical Vulnerabilities in Microsoft Windows Operating Systems CryptoAPI spoofing vulnerability – CVE-2020-0601 Multiple Windows RDP vulnerabilities – CVE-2020-0609, CVE-2020-0610, and CVE-2020-0611 https://www.us-cert.gov/ncas/alerts/aa20-014a

CISA Releases Emergency Directive and Activity Alert on Critical Microsoft Vulnerabilities The Cybersecurity and Infrastructure Security Agency (CISA) has released an Emergency Directive and Activity Alert addressing critical vulnerabilities affecting Windows CryptoAPI and Windows Remote Desktop Protocol (RDP) server and client. A remote attacker could exploit these vulnerabilities to decrypt, modify, or inject data on user connections. https://www.us-cert.gov/ncas/current-activity/2020/01/14/cisa-releases-emergency-directive-and-activity-alert-critical

Microsoft Releases January 2020 Security Updates Microsoft has released updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review Microsoft’s January 2020 Security Update Summary and Deployment Information and apply the necessary updates. https://www.us-cert.gov/ncas/current-activity/2020/01/14/microsoft-releases-january-2020-security-updates

CISA Releases Test Tool for Citrix ADC and Gateway Vulnerability – Sysadmins Can Test Now https://gbhackers.com/citrix-test-tool/

What is Cable Haunt? Cable Haunt is a critical vulnerability found in cable modems from various manufacturers across the world. The vulnerability enables remote attackers to execute abitrary code on your modem, https://cablehaunt.com/

Microsoft expected to patch major Windows security flaw today, and may NOT patch Windows 7 https://mspoweruser.com/microsoft-expected-to-patch-major-windows-security-flaw-today-and-may-not-patch-windows-7/

Cisco addressed a high-severity bug in Webex that could allow Remote Code Execution Tech giant Cisco has recently addressed two high-severity vulnerabilities affecting its Webex and IOS XE Software products. https://securityaffairs.co/wordpress/96384/security/cisco-webex-rce.html

CISA Releases Test for Citrix ADC and Gateway Vulnerability The Cybersecurity and Infrastructure Security Agency (CISA) has released a utility that enables users and administrators to test whether their Citrix Application Delivery Controller (ADC) and Citrix Gateway software is susceptible to the CVE-2019-19781 vulnerability. According to Citrix Security Bulletin CTX267027, beginning on January 20, 2020, Citrix will be releasing new versions of Citrix ADC and Citrix Gateway that will patch CVE-2019-19781. CISA strongly advises affected organizations to review CERT/CC’s Vulnerability Note VU#619785 and Citrix Security Bulletin CTX267027 and apply the mitigations until Citrix releases new versions of the software. https://www.us-cert.gov/ncas/current-activity/2020/01/13/cisa-releases-test-citrix-adc-and-gateway-vulnerability

Maze #Ransomware Publishes 14GB of Stolen Southwire Files The Maze Ransomware operators have released an additional 14GB of files that they claim were stolen from one of their victims for not paying a ransomware demand. https://www.bleepingcomputer.com/news/security/maze-ransomware-publishes-14gb-of-stolen-southwire-files/

#Sodinokibi #Ransomware Publishes Stolen Data for the First Time For the first time, the operators behind the Sodinokibi Ransomware have released files stolen from one of their victims because a ransom was not paid in time. https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-publishes-stolen-data-for-the-first-time/

PoC Exploits Released for #Citrix ADC and Gateway RCE Vulnerability It's now or never to prevent your enterprise servers running vulnerable versions of Citrix application delivery, load balancing, and Gateway solutions from getting hacked by remote attackers. https://thehackernews.com/2020/01/citrix-adc-gateway-exploit.html

#Citrix ADC CVE-2019-19781 Exploits Released, Fix Now! Numerous working exploits for the Citrix ADC (NetScaler) CVE-2019-19781 vulnerability are finally here and have been publicly posted in numerous locations. There is no patch available for this vulnerability, but Citrix has provided mitigations, which should be applied now! https://www.bleepingcomputer.com/news/security/citrix-adc-cve-2019-19781-exploits-released-fix-now/

#UnderDOCS - #Enero 2020, Número 6 📌 https://underc0de.org/foro/e-zines/underdocs-enero-2020-numero-6/msg138108/#msg138108 En esta edición disfruten de: • Criptomonedas/Blockchain • Noticias Informáticas • Hacking/Pentesting • Seguridad Informática • QA Analítica web • Privacidad • Off Topic

Alert (AA20-010A) Continued Exploitation of Pulse Secure VPN Vulnerability https://www.us-cert.gov/ncas/alerts/aa20-010a

Juniper Networks Releases Security Updates Juniper Networks has released security updates to address multiple vulnerabilities in various Juniper products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.   The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Juniper Security Advisories webpage and apply the necessary updates. https://www.us-cert.gov/ncas/current-activity/2020/01/09/juniper-networks-releases-security-updates