SysAdmin 24x7

VirusTotal debunks claims of a serious vulnerability in Google-owned antivirus service. https://portswigger.net/daily-swig/virustotal-debunks-claims-of-a-serious-vulnerability-in-google-owned-antivirus-service

QNAP warns users to disable AFP until it fixes critical bugs. Taiwanese corporation QNAP has asked customers this week to disable the AFP file service protocol on their network-attached storage (NAS) appliances until it fixes multiple critical Netatalk vulnerabilities. https://www.bleepingcomputer.com/news/security/qnap-warns-users-to-disable-afp-until-it-fixes-critical-bugs/

1Password syncing went down for a few hours today during a database upgrade. https://www.theverge.com/2022/4/27/23045469/1password-outage-password-manager-security-cloud-storage

PowerShell Elevation of Privilege Vulnerability CVE-2022-26788 Released: Apr 12, 2022 Last updated: Apr 27, 2022 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-26788 PowerShell Elevation of Privilege Vulnerability. CNA: Microsoft Corporation Base Score: 7.8 HIGH https://nvd.nist.gov/vuln/detail/CVE-2022-26788#vulnCurrentDescriptionTitle

Múltiples vulnerabilidades en dispositivos NAS de QNAP Fecha de publicación: 26/04/2022 Importancia: 4 - Alta Recursos afectados: Dispositivos NAS de QNAP con versiones: QTS 5.0.x y posteriores QTS 4.5.4 y posteriores QTS 4.3.6 y posteriores QTS 4.3.4 y posteriores QTS 4.3.3 y posteriores QTS 4.2.6 y posteriores QuTS hero h5.0.x y posteriores QuTS hero h4.5.4 y posteriores QuTScloud c5.0.x https://www.incibe.es/protege-tu-empresa/avisos-seguridad/multiples-vulnerabilidades-dispositivos-nas-qnap

April 25, 2022—KB5011831 (OS Builds 19042.1682, 19043.1682, and 19044.1682) Preview https://support.microsoft.com/en-us/topic/april-25-2022-kb5011831-os-builds-19042-1682-19043-1682-and-19044-1682-preview-fe4ff411-d25a-4185-aabb-8bc66e9dbb6c Windows 10 KB5011831 update released with 26 bug fixes, improvements https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5011831-update-released-with-26-bug-fixes-improvements/

Jira Security Advisory 2022-04-20 Summary CVE-2022-0540 - Authentication bypass in Seraph Severity: critical Fixed Jira Versions 8.13.x >= 8.13.18 8.20.x >= 8.20.6 All versions >= 8.22.0 https://confluence.atlassian.com/jira/jira-security-advisory-2022-04-20-1115127899.html

Múltiples vulnerabilidades en el core de Drupal 9 Fecha de publicación: 21/04/2022 Importancia: 3 - Media Recursos afectados: Drupal, versiones anteriores a la 9.3.12 y 9.2.18. Las versiones de Drupal 8 y de Drupal 9, anteriores a la 9.2.x, se encuentran al final de su vida útil y ya no reciben cobertura de seguridad. Descripción: Se han publicado dos vulnerabilidades de severidad media, que podrían afectar al core de Drupal. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/multiples-vulnerabilidades-el-core-drupal-9

Oracle Releases April 2022 Critical Patch Update Original release date: April 19, 2022 Oracle has released its Critical Patch Update for April 2022 to address 520 vulnerabilities across multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Oracle April 2022 Critical Patch Update and apply the necessary updates. https://www.cisa.gov/uscert/ncas/current-activity/2022/04/19/oracle-releases-april-2022-critical-patch-update

When “secure” isn’t secure at all: High‑impact UEFI vulnerabilities discovered in Lenovo consumer laptops ESET researchers discover multiple vulnerabilities in various Lenovo laptop models that allow an attacker with admin privileges to expose the user to firmware-level malware https://www.welivesecurity.com/2022/04/19/when-secure-isnt-secure-uefi-vulnerabilities-lenovo-consumer-laptops/

Workaround for security issue in 7-Zip until it is fixed. Recent versions of the open source archiver 7-Zip have a vulnerability that has not been fixed yet. Successful exploitation of the vulnerability allows privilege escalation and the execution of commands; it appears that the issue can be exploited locally only. ttps://www.ghacks.net/2022/04/18/workaround-for-security-issue-in-7-zip-until-it-is-fixed/

Auth bypass flaw in Cisco Wireless LAN Controller Software allows device takeover Cisco fixed a critical flaw in Cisco Wireless LAN Controller (WLC) that could allow an unauthenticated, remote attacker to take control affected devices. Cisco has released security patches to fix a critical vulnerability (CVSS score 10), tracked as CVE-2022-20695, in Cisco Wireless LAN Controller (WLC). A remote, unauthenticated attacker could exploit the flaw to bypass authentication and log in to the device through the management interface. https://securityaffairs.co/wordpress/130217/security/auth-bypass-cisco-wireless-lan-controller.html

Cisco Releases Security Updates for Multiple Products Original release date: April 14, 2022 Cisco has released security updates to address vulnerabilities in multiple Cisco products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Cisco Security Advisories page and apply the necessary updates. https://www.cisa.gov/uscert/ncas/current-activity/2022/04/14/cisco-releases-security-updates-multiple-products

Juniper Networks Releases Security Updates for Multiple Products Original release date: April 14, 2022 Juniper Networks has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Juniper Networks security advisories page and apply the necessary updates. https://www.cisa.gov/uscert/ncas/current-activity/2022/04/14/juniper-networks-releases-security-updates-multiple-products

VMSA-2022-0010.5 CVSSv3 Range: 9.8 Issue Date: 2022-04-02 Updated On: 2022-04-14 CVE(s): CVE-2022-22965 Synopsis: VMware Response to Spring Framework Remote Code Execution Vulnerability (CVE-2022-22965) Impacted Products VMware Tanzu Application Service for VMs (TAS) VMware Tanzu Operations Manager (Ops Manager) VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) https://www.vmware.com/security/advisories/VMSA-2022-0010.html

VMSA-2022-0013 CVSSv3 Range: 9.1 Issue Date: 2022-04-14 CVE(s): CVE-2022-22966 Synopsis: VMware Cloud Director update addresses remote code execution vulnerability (CVE-2022-22966) Impacted Products VMware Cloud Director https://www.vmware.com/security/advisories/VMSA-2022-0013.html

Vulnerabilidad RCE en Apache Struts Fecha de publicación: 13/04/2022 Importancia: 4 - Alta Recursos afectados: Struts, versiones desde la 2.0.0 hasta la 2.5.29. Descripción: El investigador Chris McCown ha reportado una vulnerabilidad de ejecución remota de código (RCE) con severidad alta, cuya explotación podría permitir a un atacante tomar el control del sistema afectado. https://www.incibe-cert.es/alerta-temprana/avisos-seguridad/vulnerabilidad-rce-apache-struts

SAP Security Patch Day –April2022 https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10

Microsoft Patch Tuesday includes most vulnerabilities since Sept. 2020 Microsoft released its latest security update Tuesday, disclosing more than 140 vulnerabilities across its array of products. This is a departure from past Patch Tuesdays this year, which have only featured a few dozen vulnerabilities, and is the largest amount of issues in a single Patch Tuesday since September 2020. [...] Windows Hyper-V contains three of the critical vulnerabilities patched this month [...] [...] There are also two critical remote code execution vulnerabilities in the Windows Network File System[...] [...] CVE-2022-24500 is another critical remote code execution vulnerability that exists in Windows SMB.[...] https://blog.talosintelligence.com/2022/04/microsoft-patch-tuesday-includes-most.html

USN-5371-1: nginx vulnerabilities 12 APRIL 2022 Several security issues were fixed in nginx. Releases Ubuntu 21.10  Ubuntu 20.04 LTS  Ubuntu 18.04 LTS  Ubuntu 16.04 ESM Packages nginx - small, powerful, scalable web/proxy server https://ubuntu.com/security/notices/USN-5371-1