SysAdmin 24x7

Critical Flaws in Cisco Small Business Switches Could Allow Remote Attacks Cisco has released updates to address a set of nine security flaws in its Small Business Series Switches that could be exploited by an unauthenticated, remote attacker to run arbitrary code or cause a denial-of-service (DoS) condition. https://thehackernews.com/2023/05/critical-flaws-in-cisco-small-business.html

Múltiples vulnerabilidades en productos Dell Fecha de publicación 19/05/2023 Importancia 5 - Crítica Recursos Afectados Versiones 19.3, 19.4, 19.7 y 19.8 de los productos: Dell Avamar Server Hardware Appliance Gen4S/ Gen4T/ Gen5A, Dell Avamar Virtual Edition, Dell Avamar NDMP Accelerator, Dell Avamar VMware Image Proxy. Dell NetWorker Virtual Edition (NVE), versiones 19.4.x 19.5.x, 19.6.x, 19.7.x y 19.8.x. Dell PowerProtect DP Series Appliance / Dell IDPA, versiones 2.5, 2.6.x y 2.7.x. Descripción Dell ha publicado un aviso catalogado como crítico para alertar de múltiples vulnerabilidades que afectan a varias versiones y modelos de algunos de sus productos (Avamar, NVE, PowerProtect e IDPA), cuya explotación por parte de un atacante podría comprometer el sistema afectado. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-productos-dell

Vulnerabilidades en productos de Apple Fecha de publicación 19/05/2023 Importancia 5 - Crítica Recursos Afectados Versiones anteriores a Safari 16.5, iOS 16.5 y iPadOS 16.5, iOS 15.7.6 y iPadOS 15.7.6, macOS Big Sur 11.7.7, macOS Ventura 13.4, macOS Monterrey 12.6.6, watchOS 9.5. Descripción Apple, junto a otros colaboradores, ha identificado varias vulnerabilidades en sus productos que podrían estar siendo explotadas de forma activa. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/vulnerabilidades-en-productos-de-apple

Vulnerabilidad 0day en Mikrotik RouterOS Fecha de publicación: 18/05/2023 Importancia: 4 - Alta Recursos Afectados Mikrotik RouterOS RADVD (Router Advertisement Daemon). Descripción Angelboy(@scwuaptx) y NiNi (@terrynini38514), investigadores de DEVCORE Research Team, han reportado una vulnerabilidad 0day en Mikrotik RouterOS RADVD, cuya explotación podría permitir a un atacante ejecutar código arbitrario con privilegios de root. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/vulnerabilidad-0day-en-mikrotik-routeros

KEEPASS 2.X MASTER PASSWORD DUMPER ALLOWS RETRIEVING THE KEEPASS MASTER PASSWORD https://securityaffairs.com/146404/hacking/keepass-2-x-master-password-dumper.html

Actualización de seguridad 6.2.1 para WordPress Fecha de publicación: 17/05/2023 Importancia: 4 - Alta Recursos Afectados: WordPress, versiones anteriores a 6.2.1. Descripción Se ha publicado la última versión de WordPress que contiene correcciones de seguridad. Solución Actualizar a la versión 6.2.1 desde la página web de WordPress o en el panel de control hacer clicc en "Actualizaciones" y luego en "Actualizar ahora". https://www.incibe.es/incibe-cert/alerta-temprana/avisos/actualizacion-de-seguridad-621-para-wordpress

Múltiples vulnerabilidades detectadas en diferentes productos Autodesk Fecha de publicación: 15/05/2023 Descripción Autodesk ha publicado varias vulnerabilidades en sus productos. Estas podrían ser explotadas por un atacante malintencionado pudiendo lograr privilegios de administrador que no le corresponden para llevar a cabo acciones ilegítimas. Estas vulnerabilidades de importancia alta son de tipo: escritura y lectura fuera de límites, desbordamiento de datos, corrupción de memoria y escalada de privilegios. https://www.incibe.es/empresas/avisos/multiples-vulnerabilidades-detectadas-en-diferentes-productos-autodesk

Chaining Five Vulnerabilities to Exploit Netgear Nighthawk RAX30 Routers at Pwn2Own Toronto 2022 The Internet of Things (IoT) has become an increasingly popular target for cyber attacks in recent years because these devices are often poorly secured and can be easily compromised. To highlight the vulnerabilities of IoT devices and encourage better security practices from manufacturers, the Zero Day Initiative (ZDI) organized a Pwn2Own competition last fall in Toronto that focused on hacking into IoT devices such as printers, network-attached storage (NAS) devices, routers, and smart speakers. This competition brought together experienced hackers to demonstrate their skills in finding and exploiting vulnerabilities in these devices. https://claroty.com/team82/research/chaining-five-vulnerabilities-to-exploit-netgear-nighthawk-rax30-routers-at-pwn2own-toronto-2022

Hypervisor Ransomware | Multiple Threat Actor Groups Hop on Leaked Babuk Code to Build ESXi Lockers https://www.sentinelone.com/labs/hypervisor-ransomware-multiple-threat-actor-groups-hop-on-leaked-babuk-code-to-build-esxi-lockers/

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game What is BPFdoor? BPFdoor is a Linux-specific, low-profile, passive backdoor intended to maintain a persistent, long-term foothold in already-breached networks and environments and functions primarily to ensure an attacker can re-enter an infected system over an extended period of time, post-compromise. https://www.deepinstinct.com/blog/bpfdoor-malware-evolves-stealthy-sniffing-backdoor-ups-its-game

New Linux kernel NetFilter flaw gives attackers root privileges A new Linux NetFilter kernel flaw has been discovered, allowing unprivileged local users to escalate their privileges to root level, allowing complete control over a system. The CVE-2023-32233 identifier has been reserved for the vulnerability, but a severity level is yet to be determined. https://www.bleepingcomputer.com/news/security/new-linux-kernel-netfilter-flaw-gives-attackers-root-privileges/

Múltiples vulnerabilidades en productos de Aruba Fecha de publicación: 10/05/2023 Importancia: 5 - Crítica https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-productos-de-aruba

Actualización de seguridad de SAP de mayo de 2023 Fecha de publicación: 10/05/2023 Importancia: 5 - Crítica https://www.incibe.es/incibe-cert/alerta-temprana/avisos/actualizacion-de-seguridad-de-sap-de-mayo-de-2023

USN-6063-1: Ceph vulnerabilities 9 May 2023 Several security issues were fixed in Ceph. Releases Ubuntu 22.10 Ubuntu 22.04 LTS Ubuntu 20.04 LTS Ubuntu 18.04 ESM https://ubuntu.com/security/notices/USN-6063-1

May 2023 Security Updates https://msrc.microsoft.com/update-guide/releaseNote/2023-May

FG-IR-22-297 Date May 3, 2023 Severity High CVSSv3 Score 7.6 Impact Execute unauthorized code or commands CVE ID CVE-2023-27999 Affected Products FortiADC : 7.2.0, 7.1.1, 7.1.0 https://www.fortiguard.com/psirt/FG-IR-22-297

Android’s May 2023 security patch prevents downgrades to infinitely old system app versions You can no longer downgrade system apps beyond the pre-installed version https://www.androidpolice.com/android-may-2023-security-patch-no-downgrades-infinitely-old-system-app-versions/

Elastic Security Labs discovers the LOBSHOT malware An analysis of LOBSHOT, an hVNC malware family spreading through Google Ads. https://www.elastic.co/security-labs/elastic-security-labs-discovers-lobshot-malware

Apple’s first Rapid Security Response patch fails to install on iPhones Apple has launched the first Rapid Security Response (RSR) patches for iOS 16.4.1 and macOS 13.3.1 devices, with some users having issues installing them on their iPhones. https://www.bleepingcomputer.com/news/apple/apples-first-rapid-security-response-patch-fails-to-install-on-iphones/

VMSA-2023-0008 CVSSv3 Range:7.3-9.3 Issue Date:2023-04-25 CVE(s): CVE-2023-20869, CVE-2023-20870, CVE-2023-20871, CVE-2023-20872 Synopsis: VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2023-20869, CVE-2023-20870, CVE-2023-20871, CVE-2023-20872) https://www.vmware.com/security/advisories/VMSA-2023-0008.html