SysAdmin 24x7

Critical PuTTY Vulnerability Allows Secret Key Recovery PuTTY vulnerability CVE-2024-31497 allows attackers to compromise private keys and use them to forge signatures. https://www.securityweek.com/critical-putty-vulnerability-allows-secret-key-recovery/

Telegram fixes Windows app zero-day used to launch Python scripts Telegram fixed a zero-day vulnerability in its Windows desktop application that could be used to bypass security warnings and automatically launch Python scripts. https://www.bleepingcomputer.com/news/security/telegram-fixes-windows-app-zero-day-used-to-launch-python-scripts/

Citrix Releases Security Updates for XenServer and Citrix Hypervisor Release DateApril 12, 2024 Citrix released security updates to address multiple vulnerabilities in XenServer and Citrix Hypervisor. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review and apply the necessary updates: XenServer and Citrix Hypervisor Security Update for CVE-2023-46842, CVE-2024-2201 and CVE-2024-31142 https://www.cisa.gov/news-events/alerts/2024/04/12/citrix-releases-security-updates-xenserver-and-citrix-hypervisor

Juniper Releases Security Bulletin for Multiple Juniper Products Release DateApril 12, 2024 Juniper has released security updates to address multiple vulnerabilities in Junos OS, Junos OS Evolved, Paragon Active Assurance and Junos OS: EX4300 Series. A cyber threat actor could exploit some of these vulnerabilities to cause a denial-of-service condition. Users and administrators are encouraged to review Juniper’s Support Portal and apply the necessary updates. https://www.cisa.gov/news-events/alerts/2024/04/12/juniper-releases-security-bulletin-multiple-juniper-products

Palo Alto Networks Releases Guidance for Vulnerability in PAN-OS, CVE-2024-3400 Last RevisedApril 12, 2024 Palo Alto Networks has released workaround guidance for a command injection vulnerability (CVE-2024-3400) affecting PAN-OS versions 10.2, 11.0, and 11.1. Palo Alto Networks has reported active exploitation of this vulnerability in the wild. CISA encourages users and administrators to review the Palo Alto Networks Security Advisory, apply the current mitigations, and update the affected software when Palo Alto Networks makes the fixes available. CISA has also added this vulnerability to its Known Exploited Vulnerabilities Catalog. Additional resources: Palo Alto Networks: Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 Volexity: Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) https://www.cisa.gov/news-events/alerts/2024/04/12/palo-alto-networks-releases-guidance-vulnerability-pan-os-cve-2024-3400

Múltiples vulnerabilidades en UCA de HPE Fecha 10/04/2024 Importancia 5 - Crítica Recursos Afectados Unified Correlation Analyzer (UCA), versiones anteriores a v4.4.0. Descripción HPE ha publicado 11 vulnerabilidades, 5 de severidad crítica y 6 altas que podrían permitir a un atacante ejecución de código, denegación de servicio (DoS), acceso no autorizado, corrupción de memoria, entidad externa XML (XXE) o deserialización insegura. Solución HPE ha proporcionado una actualización a la versión 4.4.0 para solucionar dichas vulnerabilidades https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-uca-de-hpe

Múltiples vulnerabilidades en productos de Fortinet Fecha 10/04/2024 Importancia 5 - Crítica Recursos Afectados Las siguientes versiones de FortiClientLinux están afectadas: 7.2.0. 7.0.6 hasta 7.0.10; 7.0.3 hasta 7.0.4. Las siguientes versiones de FortiClientMac están afectadas: 7.2.0 hasta 7.2.3; 7.0.6 hasta 7.0.10. Descripción CataLpa de Dbappsecurity Co. Ltd y Tomas Kabrt, han reportado 3 vulnerabilidades, una de severidad crítica y dos de severidad alta, cuya explotación podría permitir a un atacante ejecutar código arbitrario. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-productos-de-fortinet

Actualización de seguridad de SAP de abril de 2024 Fecha 10/04/2024 Importancia 4 - Alta Recursos Afectados SAP NetWeaver AS Java User Management Engine, en sus versiones versiones: SERVERCORE 7.50, J2EE-APPS 7.50 y UMEADMIN 7.50. SAP BusinessObjects Web Intelligence, versiones 4.2 y 4.3. SAP Asset Accounting, en sus versiones: SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_APPL 600, SAP_FIN617, SAP_FIN 618 y SAP_FIN700. El resto de productos afectados por vulnerabilidades cuya severidad no es alta, pueden consultarse en las referencias. Descripción SAP ha publicado varias actualizaciones de seguridad en diferentes productos en su comunicado mensual. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/actualizacion-de-seguridad-de-sap-de-abril-de-2024

Microsoft April 2024 Security Updates https://msrc.microsoft.com/update-guide/releaseNote/2024-Apr

Actualización en Adobe Commerce y Magento Open Source para corregir vulnerabilidades críticas Fecha 10/04/2024 Importancia 4 - Alta Recursos Afectados Adobe Commerce, versiones: 2.4.7-beta3; 2.4.6-p4; 2.4.5-p6; 2.4.4-p7; 2.4.3-ext-6; 2.4.2-ext-6; 2.4.1-ext-6; 2.4.0-ext-6; 2.3.7-p4-ext-6 y anteriores. Magento Open Source, versiones: 2.4.7 para 2.4.7-beta3; 2.4.6-p5 para 2.4.6-p4; 2.4.5-p7 para 2.4.5-p6; 2.4.4-p8 para 2.4.4-p7 y anteriores. Descripción Adobe ha publicado una actualización de seguridad que corrige vulnerabilidades críticas en Adobe Commerce y Magento Open Source. Estas vulnerabilidades, de ser explotadas con éxito, podrían permitir a un ciberdelincuente ejecutar código arbitrario. https://www.incibe.es/empresas/avisos/actualizacion-en-adobe-commerce-y-magento-open-source-para-corregir

Vulnerabilidad de denegación de servicio en puntos de acceso de Tp-Link Fecha 10/04/2024 Importancia 4 - Alta Recursos Afectados Punto de acceso inalámbrico MU-MIMO Gigabit Tp-Link AC1350 (EAP225 v3) v5.1.0 Compilación 20220926. Punto de acceso inalámbrico Tp-Link N300 (EAP115) v5.0.4 Compilación 20220216. Descripción Se ha detectado una vulnerabilidad de severidad alta que afecta a un modelo concreto de puntos de acceso de la marca Tp-Link. En caso de ser explotada con éxito, podría permitir a un ciberdelincuente restablecer la configuración de fábrica del dispositivo, denegando así el servicio del mismo. https://www.incibe.es/empresas/avisos/vulnerabilidad-de-denegacion-de-servicio-en-puntos-de-acceso-de-tp-link

More than 16,000 Ivanti VPN gateways still vulnerable to RCE CVE-2024-21894 Experts warn of roughly 16,500 Ivanti Connect Secure and Poly Secure gateways still vulnerable to a remote code execution (RCE) flaw. https://securityaffairs.com/161544/security/ivanti-16500-vulnerable-istances.html

Recent Windows updates break Microsoft Connected Cache delivery Microsoft says Windows 10 updates released since the start of the year are breaking Microsoft Connected Cache (MCC) node discovery on enterprise networks. MCC servers are software-only caching solutions that can be deployed on Windows servers, bare-metal servers, or VMs to cache and deliver content downloaded from Microsoft's content delivery network (CDN). https://www.bleepingcomputer.com/news/microsoft/recent-windows-updates-break-microsoft-connected-cache-delivery/

Critical Vulnerability CVE-2024-2879 Found in LayerSlider Plugin for WordPress A severe security vulnerability has been identified in the LayerSlider plugin for WordPress, which could potentially allow malicious actors to extract sensitive data from databases, including password hashes. The vulnerability, known as CVE-2024-2879, has been assigned a CVSS score of 9.8, indicating its critical nature. The issue is an instance of SQL injection and affects LayerSlider versions from 7.9.11 to 7.10.0. https://zerosecurity.org/2024/04/critical-vulnerability-cve-2024-2879-found-in-layerslider-plugin-for-wordpress/

Ejecución de código remoto en PCOMM de IBM Fecha 08/04/2024 Importancia 5 - Crítica Recursos Afectados PCOMM, v14.0.6 PCOMM v15.0.1 Descripción IBM ha publicado una vulnerabilidad de severidad crítica en su servicio PCOMM que podría permitir a un atacante con pocos privilegios moverse lateralmente a los sistemas afectados y aumentar sus privilegios. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/ejecucion-de-codigo-remoto-en-pcomm-de-ibm?sstc=u13002nl506144

Múltiples vulnerabilidades en productos de CData Fecha 08/04/2024 Importancia 5 - Crítica Recursos Afectados CData API Server, versiones anteriores a 23.4.8844; CData Arc, versiones anteriores a 23.4.8839; CData Connect, versiones anteriores a 23.4.8846; CData Sync, versiones anteriores a 23.4.8843. Descripción Un investigador de Tenable ha descubierto 4 vulnerabilidades, 2 de severidad crítica y 2 altas que podrían provocar que un atacante eluda las restricciones de seguridad previstas o realice acciones confidenciales que de otro modo estarían restringidas a un usuario autenticado. https://www.incibe.es/incibe-cert/alerta-temprana/avisos/multiples-vulnerabilidades-en-productos-de-cdata?sstc=u13002nl506144

VMSA-2024-0008 CVSSv3 Range: 7.4-4.8 Issue Date: 2024-04-02 CVE(s): CVE-2024-22246, CVE-2024-22247, CVE-2024-22248 Synopsis: VMware SD-WAN Edge and SD-WAN Orchestrator updates address multiple security vulnerabilities. Impacted Products VMware SD-WAN Edge VMware SD-WAN Orchestrator 2. Introduction Multiple vulnerabilities in VMware SD-WAN were privately reported to VMware. Patches and instructions are available to remediate the vulnerabilities in affected VMware products. https://www.vmware.com/security/advisories/VMSA-2024-0008.html

Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise Advisory ID: SVD-2024-0301 CVE ID: CVE-2024-29945 Published: 2024-03-27 Description In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure could happen when either Splunk Enterprise runs in debug mode or the JsonWebToken component has been configured to log its activity at the DEBUG logging level. Normally, Splunk Enterprise runs with debug mode and token authentication turned off, as well as the JsonWebToken process configured at the INFO logging level. https://advisory.splunk.com/advisories/SVD-2024-0301

CVE-2024-3094 Public on 29 de marzo de 2024 Critical Impact CVSS Score 10.0 Description Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library. https://access.redhat.com/security/cve/CVE-2024-3094

Cisco Releases Security Updates for Multiple Products 03/28/2024 12:46 PM EDT Cisco released security updates to address vulnerabilities in Cisco IOS, IOS XE, and AP software. A cyber threat actor could exploit some of these vulnerabilities to cause a denial-of-service. CISA encourages users and administrators to review the following advisories and apply the necessary updates: Cisco Event Response: March 2024 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication Cisco Access Point Software Secure Boot Bypass Vulnerability Cisco Access Point Software Denial of Service Vulnerability https://www.cisa.gov/news-events/alerts/2024/03/28/cisco-releases-security-updates-multiple-products