Mass exploitation began over the weekend for yet another critical vulnerability in widely used VPN software sold by Ivanti, as hackers already targeting two previous vulnerabilities diversified, researchers said Monday.

The new vulnerability, tracked as CVE-2024-21893, is what’s known as a server-side request forgery. Ivanti disclosed it on January 22, along with a separate vulnerability that so far has shown no signs of being exploited. Last Wednesday, nine days later, Ivanti said CVE-2024-21893 was under active exploitation, aggravating an already chaotic few weeks. All of the vulnerabilities affect Ivanti’s Connect Secure and Policy Secure VPN products.

A tarnished reputation and battered security professionals

The new vulnerability came to light as two other vulnerabilities were already under mass exploitation, mostly by a hacking group researchers have said is backed by the Chinese government. Ivanti provided mitigation guidance for the two vulnerabilities on January 11 and released a proper patch last week. The Cybersecurity and Infrastructure Security Agency, meanwhile, mandated all federal agencies under its authority disconnect Ivanti VPN products from the Internet until they are rebuilt from scratch and running the latest software version.

By Sunday, attacks targeting CVE-2024-21893 had mushroomed, from hitting what Ivanti said was a “small number of customers” to a mass base of users, research from security organization Shadowserver showed. The steep line in the right-most part of the following graph tracks the vulnerability’s meteoric rise starting on Friday. At the time this Ars post went live, the exploitation volume of the vulnerability exceeded that of CVE-2023-46805 and CVE-2024-21887, the previous Ivanti vulnerabilities under active targeting.

Systems that had been inoculated against the two older vulnerabilities by following Ivanti’s mitigation process remained wide open to the newest vulnerability, a status that likely made it attractive to hackers. There’s something else that makes CVE-2024-21893 attractive to threat actors: because it resides in Ivanti’s implementation of the open source Security Assertion Markup Language—which handles authentication and authorization between parties—people who exploit the bug can bypass normal authentication measures and gain access directly to the administrative controls of the underlying server.

Exploitation likely got a boost from proof-of-concept code released by security firm Rapid7 on Friday, but the exploit wasn’t the sole contributor. Shadowserver said it began seeing working exploits a few hours before the Rapid7 release. All of the different exploits work roughly the same way. Authentication in Ivanti VPNs occurs through the doAuthCheck function in an HTTP web server binary located at /root/home/bin/web. The endpoint /dana-ws/saml20.ws doesn’t require authentication. As this Ars post was going live, Shadowserver counted a little more than 22,000 instances of Connect Secure and Policy Secure.

VPNs are an ideal target for hackers seeking access deep inside a network. The devices, which allow employees to log in to work portals using an encrypted connection, sit at the very edge of the network, where they respond to requests from any device that knows the correct port configuration. Once attackers establish a beachhead on a VPN, they can often pivot to more sensitive parts of a network.

The three-week spree of non-stop exploitation has tarnished Ivanti’s reputation for security and battered security professionals as they have scrambled—often in vain—to stanch the flow of compromises. Compounding the problem was a slow patch time that missed Ivanti’s own January 24 deadline by a week. Making matters worse still: hackers figured out how to bypass the mitigation advice Ivanti provided for the first pair of vulnerabilities.

Given the false starts and high stakes, CISA’s Friday mandate of rebuilding all servers from scratch once they have installed the latest patch is prudent. The requirement doesn’t apply to non-government agencies, but given the chaos and difficulty securing the Ivanti VPNs in recent weeks, it’s a common-sense move that all users should have taken by now.

https://arstechnica.com/?p=2001230

UEFI firmware from five of the leading suppliers contains vulnerabilities that allow attackers with a toehold in a user’s network to infect connected devices with malware that runs at the firmware level.

The vulnerabilities, which collectively have been dubbed PixieFail by the researchers who discovered them, pose a threat mostly to public and private data centers, and their users of course. People with even minimal access to such a network—say a paying customer, a low-level employee, or an attacker who has already gained limited entry—can exploit the vulnerabilities to infect connected devices with a malicious UEFI. Short for Unified Extensible Firmware Interface, UEFI is the low-level and complex chain of firmware responsible for booting up virtually every modern computer. By installing malicious firmware that runs prior to the loading of a main OS, UEFI infections can’t be detected or removed using standard endpoint protections. They also give unusually broad control of the infected device.

Five vendors, and many a customer, affected

The nine vulnerabilities that comprise PixieFail reside in TianoCore EDK II, an open source implementation of the UEFI specification. The implementation is incorporated into offerings from Arm Ltd., Insyde, AMI, Phoenix Technologies, and Microsoft. The flaws reside in functions related to IPv6, the successor to the IPv4 Internet Protocol network address system. They can be exploited in what’s known as the PXE, or Preboot Execution Environment, when it’s configured to use IPv6.

PXE, sometimes colloquially referred to as Pixieboot or netboot, is a mechanism enterprises use to boot up large numbers of devices, which more often than not are servers inside of large data centers. Rather than the OS being stored on the device booting up, PXE stores the image on a central server, known as a boot server. Devices booting up locate the boot server using the Dynamic Host Configuration Protocol and then send a request for the OS image.

PXE is designed for ease of use, uniformity, and quality assurance inside data centers and cloud environments. When updating or reconfiguring the OS, admins need to do so only once and then ensure that hundreds or thousands of connected servers run it each time they boot up.

By exploiting the PixieFail vulnerabilities, an attacker can cause servers to download a malicious firmware image rather than the intended one. The malicious image in this scenario will establish a permanent beachhead on the device that’s installed prior to the loading of the OS and any security software that would normally flag infections.

The vulnerabilities and proof-of-concept code demonstrating the presence of the vulnerabilities were developed by researchers from security firm Quarkslab, which published the findings Tuesday.

The network presence required to exploit most of the vulnerabilities is relatively minor. Attackers need not establish their own malicious server or gain high-level privileges. Instead, the attacker only needs the ability to view and capture traffic as it traverses the local network. This kind of access may be possible when someone has a legitimate account with a cloud service or after first exploiting a separate vulnerability that gives limited system rights. With that, the attacker can then exploit PixieFail to plant a UEFI-controlled backdoor in huge fleets of servers.

Quarkslab Chief Research Officer Iván Arce said in an interview:

An attacker doesn’t need to have physical access neither to the client nor the boot server. The attacker just needs to have access to the network where all these systems are running and it needs to have the ability to capture packets and to inject packets or transmit packets. When the client-{based server] boots, the attacker just needs to send the client a malicious packet in the [request] response that will trigger some of these vulns. The only access that the attacker needs is access to the network, not physical access to any of the clients, nor to the boot server or DHCP server. Just capture packets or send packets in the network, where all these servers are running.

For PixieFail to be exploited, PXE must be turned on. For the overwhelming number of UEFIs in use, PXE isn’t turned on. PXE is generally used only in data centers and cloud environments for rebooting thousands or tens of thousands of servers. Additionally, PXE must be configured to be used in combination with IPv6 routing.

https://arstechnica.com/?p=1996543

Threat actors have started exploiting a critical information disclosure vulnerability in the open source file-sharing and collaboration software ownCloud only days after its public disclosure.

The vulnerability, tracked as CVE-2023-49103, impacts the Graphapi app, allowing attackers to retrieve sensitive environment variables, including credentials, license keys, and other system information.

Impacting Graphapi versions 0.2.0 to 0.3.0, the flaw cannot be mitigated by disabling the Graphapi app, and also requires changing passwords for administrative accounts, access keys, and credentials for the mail server and database.

ownCloud disclosed the vulnerability on November 21, along with two other critical issues in the software (CVE-2023-49104 and CVE-2023-49105). On Monday, the US cybersecurity agency CISA included the bugs in its weekly vulnerability roundup, without a severity rating.

Also on Monday, attack activity and exposed asset tracking services issued warnings about the first in-the-wild exploitation attempts targeting CVE-2023-49103.

Nonprofit cybersecurity organization Shadowserver Foundation warned that it has identified roughly 11,000 ownCloud instances that are exposed to the internet, and which are potentially at risk.

The largest number of these instances are in Germany (2,000), followed by the US (1,400), and France (1,300). Russia, Poland, the Netherlands, Italy, the UK, Canada, and Spain round up top 10, with hundreds of instances each.

Shadowserver warns that the vulnerability is very easy to exploit, urging administrators to follow the mitigation steps outlined by ownCloud.

According to data from Greynoise, the targeting of CVE-2023-49103 started on November 25, with attacks originating from a single IP address. The number of exploitation attempts increased on Monday, with 11 unique IPs joining the fray.

Johannes Ullrich of the SANS Internet Storm Center too warned of activity targeting the ownCloud vulnerability, detailing five IPs involved in the observed attacks, which have scanned for files within vulnerable ownCloud instances.

“This pattern can suggest potential coordinated efforts by threat actors or botnets aiming to exploit the disclosed security flaw,” SOC Radar notes.

Ullrich, however, points out that there is a steady flow of attacks targeting ownCloud instances, many of which “are likely just attempting to find instances of ownCloud to exploit old vulnerabilities or attempt weak passwords”.

Related: Mass Exploitation of ‘Citrix Bleed’ Vulnerability Underway

Related: In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover

Related: Exploitation of Recent Citrix ShareFile RCE Vulnerability Begins

https://www.securityweek.com/exploitation-of-critical-owncloud-vulnerability-begins/

Open-source file-sharing and collaboration software ownCloud is plagued by critical vulnerabilities that could lead to the exposure of credentials and other sensitive information and to authentication and validation bypass.

The most serious issue, which carries a CVSS score of 10/10, impacts the graphapi app, which uses a third-party library providing a URL that, when accessed, reveals the PHP environment’s configuration details (phpinfo).

“This information includes all the environment variables of the webserver. In containerized deployments, these environment variables may include sensitive data such as the ownCloud admin password, mail server credentials, and license key,” ownCloud warned in an advisory.

Additional sensitive data included in phpinfo may allow an attacker to gather further information about the system and the variable should be concerning for all administrators if ownCloud is not running in a containerized environment.

“It’s important to emphasize that simply disabling the graphapi app does not eliminate the vulnerability,” ownCloud notes. The issue impacts graphapi versions 0.2.0 to 0.3.0.

Administrators are advised to change the ownCloud admin password, the Object-Store/S3 access-key, and credentials for the mail server and database. “Additionally, we disabled the phpinfo function in our docker-containers. We will apply various hardenings in future core releases to mitigate similar vulnerabilities,” ownCloud added.

A second vulnerability, tagged with a CVSS severity score of 9.8/10, is described as an authentication bypass in the WebDAV API, through pre-signed URLs.

“It is possible to access, modify or delete any file without authentication if the username of the victim is known and the victim has no signing-key configured (which is the default),” ownCloud explained.

The bug impacts ownCloud core versions 10.6.0 to 10.13.0 and can be mitigated by denying the use of pre-signed URLs if there is no signing key configured for the file owner.

A third bug (CVSS score of 9/10), impacting the oauth2 app versions prior to 0.6.1, could lead to the bypass of subdomain validation.

“Within the oauth2 app an attacker is able to pass in a specially crafted redirect-URL which bypasses the validation code and thus allows the attacker to redirect callbacks to a TLD controlled by the attacker,” ownCloud said.

Related: Over a Dozen Exploitable Vulnerabilities Found in AI/ML Tools

Related: Microsoft Patches Sensitive Information Disclosure Bug in Azure CLI

Related: SAP Patches Critical Vulnerability in Business One Product

https://www.securityweek.com/critical-owncloud-flaws-lead-to-sensitive-information-disclosure-authentication-bypass/

Microsoft announced on Tuesday that it is willing to pay up to $20,000 for vulnerabilities reported as part of a new bug bounty program for Defender products.

The new Microsoft Defender Bounty Program kicks off with Defender for Endpoint APIs, but the tech giant says other products in the Defender brand will be added in time.

“The Microsoft Defender Bounty Program invites researchers across the globe to identify vulnerabilities in Defender products and services and share them with our team,” the company says.

Participating researchers may earn between $500 and $20,000 for the identified flaws, depending on impact and report quality.

The highest rewards, Microsoft says, may be awarded for critical-severity remote code execution (RCE) bugs. The company is willing to hand out up to $8,000 for critical elevation of privilege and information disclosure issues, and may offer up to $3,000 for spoofing and tampering vulnerabilities.

To qualify for a bug bounty reward, researchers need to report flaws that are within the scope of the program, which have not been previously reported, and which can be reproduced on the latest, fully patched version of the product.

In-scope vulnerabilities include cross-site scripting (XSS), cross-site request forgery (CSRF), server-side request forgery (SSRF), cross-tenant data tampering or access, insecure direct object references and insecure deserialization, injection, server-side code execution, and security misconfiguration issues.

Reports covering components with known vulnerabilities should also include proof-of-concept (PoC) exploit code, the tech giant says.

The reports need to be clear and concise, and should include the information necessary to reproduce the issue.

All reports, Microsoft says, should be submitted through the MSRC Researcher Portal, indicate which high-impact scenario they qualify for, and should describe the attack vector for the bug.

“The Defender Bounty program’s scope is limited to technical vulnerabilities in Defender-related products and services. If you discover customer data while conducting your research, or are unclear if it is safe to proceed, please stop and contact us,” the tech giant notes.

Further details on the Microsoft Defender Bounty Program can be found on the MSRC portal.

Related: Microsoft Paid Out $63 Million Since Launch of First Bug Bounty Program 10 Years Ago

Related: Microsoft Offers Up to $15,000 in New AI Bug Bounty Program

Related: Microsoft Paid Out $13 Million via Bug Bounty Programs for Fourth Consecutive Year

https://www.securityweek.com/microsoft-offers-up-to-20000-for-vulnerabilities-in-defender-products/

Australian and US governmental agencies and Citrix this week issued fresh warnings on the exploitation of a critical NetScaler product vulnerability.

Tracked as CVE-2023-4966 (CVSS score of 9.4) and referred to as CitrixBleed, the unauthenticated bug leads to information disclosure. It impacts Netscaler ADC and Gateway appliances that are configured as a gateway or an AAA server.

Patched in October, the flaw had been exploited as a zero-day since August, and mass exploitation started roughly three weeks ago, around the same time that a proof-of-concept (PoC) exploit and a technical writeup were published.

In late October, the tech giant warned that threat actors were exploiting the issue to perform session hijacking, completely bypassing authentication, including MFA protections.

On Monday, Citrix urged administrators to apply the available patches as soon as possible, citing “a sharp increase in attempts to exploit this vulnerability in unpatched NetScaler ADCs” and reports that the LockBit ransomware gang has started exploiting it.

An alert on LockBit targeting CitrixBleed also came from the US cybersecurity agency CISA, the FBI, the Multi-State Information Sharing and Analysis Center (MS-ISAC), and the Australian Cyber Security Center (ACSC), on Tuesday.

“Historically, LockBit affiliates have conducted attacks against organizations of varying sizes across multiple critical infrastructure sectors—including education, energy, financial services, food and agriculture, government and emergency services, healthcare, manufacturing, and transportation,” the governmental agencies warn.

LockBit, the four agencies say, exploited CitrixBleed to gain initial access to Boeing Distribution Inc., the parts and distribution subsidiary of aeronautical giant Boeing.

Armed with valid cookies obtained by exploiting CVE-2023-4966, the LockBit affiliates then established an authenticated session with the appliance, which allowed them to execute a PowerShell script for malware deployment.

“Through the takeover of legitimate user sessions, malicious actors acquire elevated permissions to harvest credentials, move laterally, and access data and resources,” the agencies note.

In their alert, CISA, FBI, MS-ISAC, and ACSC provide a list of indicators of compromise (IoCs) associated with the LockBit attack on Boeing, recommending hunting for evidence of compromise and urging immediate patching.

Administrators are advised to update to NetScaler ADC and Gateway versions 14.1-8.50, 13.1-49.15, 13.0-92.19, and NetScaler ADC 13.1-FIPS 13.1-37.164, 12.1-FIPS 12.1-55.300, and 12.1-NDcPP 12.1-55.300, which address the vulnerability.

After the upgrade, they should remove any active or persistent sessions, to ensure the flaw is fully mitigated – Citrix has provided detailed information on how this can be done. Because the session cookies persist in memory, threat actors can retrieve them even after the update.

Related: CitrixBleed Vulnerability Exploitation Suspected in Toyota Ransomware Attack

Related: Operations at Major Australian Ports Significantly Disrupted by Cyberattack

Related: Atlassian Issues Second Warning on Potential Exploitation of Critical Confluence Flaw

https://www.securityweek.com/citrix-gov-agencies-issue-fresh-warnings-on-citrixbleed-vulnerability/

Microsoft on Monday announced that it has paid out $63 million in rewards to the security researchers participating in its bug bounty programs.

The tech giant launched its first bug bounty programs in 2013, when it was accepting reports of exploitation techniques in Windows 8.1 and flaws in the preview version of Internet Explorer 11.

Initially, Microsoft was receiving less than 100 reports annually, from the few dozen researchers who were participating. The company was paying a few hundred dollars in rewards annually.

Now, the company is running 17 bug bounty programs covering Azure, Edge, Microsoft 365, Windows, Xbox, and more, with rewards of up to $250,000 offered for high-impact bugs in the Hyper-V hypervisor.

According to Microsoft, thousands of security researchers from 70 countries are now receiving bug bounties. Students, academics, and full-time cybersecurity professionals are also participating in the company’s bug bounty programs.

Of the total $63 million handed out since 2013, $60 million were paid over the past five years, the company says. Starting 2020, Microsoft has been handing out more than $13 million annually to roughly 300 researchers.

“The data from the programs is a critical part of arming product and security teams across the company to deliver broader security improvements and mitigations beyond one-off bug fixes,” Microsoft says.

Since 2013, Microsoft has changed its bug bounty rewards policies several times, to offer monetary payments even for bugs that had already been discovered internally, and to make it clearer for researchers what vulnerability reports are eligible.

The award amounts were increased as well, concentrating on flaws with increased customer impact, and patching times have been shortened, the tech giant says.

“Today, incentives and partnership are baked into our company’s vulnerability disclosure program. Every report that is triaged, assessed, and fixed is reviewed for potential bounty eligibility. There is no need to register, no need to sign up, everyone is invited,” the company notes.

Related: Microsoft Offers Up to $15,000 in New AI Bug Bounty Program

Related: Hacker Conversations: Natalie Silvanovich From Google’s Project Zero

Related: Google Announces Bug Bounty Program and Other Initiatives to Secure AI

https://www.securityweek.com/microsoft-paid-out-63-million-since-launch-of-first-bug-bounty-program-10-years-ago/

Since August 2023, members of the Huntr bug bounty platform for artificial intelligence (AI) and machine learning (ML) have uncovered over a dozen vulnerabilities exposing AI/ML models to system takeover and sensitive information theft.

Identified in tools with hundreds of thousands or millions of downloads per month, such as H2O-3, MLflow, and Ray, these issues potentially impact the entire AI/ML supply chain, says Protect AI, which manages Huntr.

A low-code machine learning platform, H2O-3 supports the creation and deployment of ML models via a web interface, by just importing data. It allows users to upload Java objects remotely via API calls.

By default, the installation is exposed to the network and does not require authentication, thus allowing attackers to supply malicious Java objects that H2O-3 would execute, allowing them to access the operating system.

Tracked as CVE-2023-6016 (CVSS score of 10), the remote code execution (RCE) vulnerability could allow attackers to completely take over the server and steal models, credentials, and other data.

The bug hunters uncovered two other critical issues in the low-code service, namely a local file include flaw (CVE-2023-6038) and a cross-site scripting (XSS) bug (CVE-2023-6013), along with a high-severity S3 bucket takeover vulnerability (CVE-2023-6017).

MLflow, an open-source platform for the management of the end-to-end ML lifecycle, also lacks authentication by default, and the researchers identified four critical vulnerabilities in it.

The most severe of these are arbitrary file write and patch traversal bugs (CVE-2023-6018 and CVE-2023-6015, CVSS score of 10) that can allow an unauthenticated attacker to overwrite arbitrary files on the operating system and achieve RCE.

The tool was also found vulnerable to critical-severity arbitrary file inclusion (CVE-2023-1177) and authentication bypass (CVE-2023-6014) vulnerabilities.

The Ray project, an open-source framework for the distributed training of ML models, also lacks default authentication.

A critical code injection flaw in Ray’s cpu_profile format parameter (CVE-2023-6019, CVSS score of 10) could lead to full system compromise. The parameter was not validated before being inserted in a system command that was executed in a shell.

The bug hunters also identified two critical local file include issues that could allow remote attackers to read any files on the Ray system. The security defects are tracked as CVE-2023-6020 and CVE-2023-6021.

All vulnerabilities were reported to vendors at least 45 days prior to public disclosure. Users are advised to update their installations to the latest non-vulnerable versions and restrict access to the applications where patches are not available. 

Related: The Good, the Bad and the Ugly of Generative AI

Related: OpenAI Patches Account Takeover Vulnerabilities in ChatGPT

Related: Major ChatGPT Outage Caused by DDoS Attack

https://www.securityweek.com/over-a-dozen-exploitable-vulnerabilities-found-in-ai-ml-tools/

Microsoft on Tuesday released patches and guidance for addressing a high-severity vulnerability in Azure Command-Line Interface (CLI) that could result in the exposure of sensitive information, such as credentials, through GitHub Actions logs.

Tracked as CVE-2023-36052 (CVSS score of 8.6) and addressed with the release of Azure CLI 2.54 as part of the November 2023 Patch Tuesday, the bug existed because certain Azure CLI functions would inadvertently expose secrets through CI/CD logs.

While there are many functions that echo environment variables to the log, including credentials, and the action is performed as intended, this led to the sensitive information being exposed to everyone, for public repositories, and allowed attackers with ‘Read’ permissions on private repositories to retrieve it.

“An attacker that successfully exploited this vulnerability could recover plaintext passwords and usernames from log files created by the affected CLI commands and published by Azure DevOps and/or GitHub Actions,” Microsoft notes in its advisory.

Palo Alto Networks security researcher Aviad Hahami, who reported the bug to Microsoft, analyzed various usage patterns related to Azure CLI in GitHub Actions and identified three main variations in the wild.

Some developers, Hahami notes, did not know about the issue and put no mitigation in place, exposing themselves to attackers, others assumed Azure CLI would leak sensitive information and masked it themselves, while others attempted to mask the secrets but ended up leaking them by setting up separate pipelines for ‘create’ and ‘delete’ (or equivalent) actions.

In guidance on addressing CVE-2023-36052, Microsoft explains that changes were made to several Azure CLI commands and that additional changes will be made to harden Azure CLI against secrets exposure.

The tech giant changed multiple products, including Azure Pipelines, GitHub Actions, and Azure CLI, to improve secret redaction, including by adding a new default setting that prevents secrets leaking in the output of update commands for services in the App Service family.

“Note that this change might adversely impact some automation workflows since certain users might expect secret values in the Azure CLI response to then be used in subsequent parts of the workflow. However, there are safer authoring patterns for automation that we encourage customers to consider,” Microsoft notes.

The company also expanded credential redaction capabilities in GitHub Actions and Azure Pipelines to identify more key patterns in logs and mask them.

“This redaction is designed to target a specific set of keys for accuracy and performance reasons and is intended to catch any Microsoft-issued keys that may have inadvertently found their way into public-facing logs,” the tech giant says.

Microsoft recommends that all customers follow security best practices for cloud workload development and protection, including by keeping Azure CLI updated, not exposing Azure CLI output in logs and publicly accessible locations, rotating keys and secrets regularly, keeping repositories private, and reviewing available guidance on secrets management and the security of GitHub Actions and Azure Pipelines.

Related: Stolen GitHub Credentials Used to Push Fake Dependabot Commits

Related: Zero-Day Summer: Microsoft Warns of Fresh New Software Exploits

Related: Researchers Flag Account Takeover Flaw in Microsoft Azure AD OAuth Apps

https://www.securityweek.com/microsoft-patches-sensitive-information-disclosure-vulnerability-in-azure-cli/

The world’s largest software maker Microsoft on Tuesday released patches with cover for at least 59 documented security vulnerabilities, including a pair of critical-severity zero-days already being exploited in the wild.

Redmond’s security response team documented a wide range of security defects in a range of Windows OS and components and called special attention to two vulnerabilities — CVE-2023-36033 and CVE-2023-36036 being exploited in active attacks.

“An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft said two separate advisories that credit security researcher Quan Jin, DBAPPSecurity WeBin Lab and its own threat-intel teams for discovering the two zero-days.

As is customary, Microsoft’s barebones bulletins did not contain any details on the live attacks or indicators of compromise to help defenders hunt for signs of infections.

The Patch Tuesday rollout also fixes the known — and already exploited — WepP flaw affecting its Microsoft Edge (Chromium-based browser) and remote code execution issues in the Windows cURL Implementation.

Microsoft also pushed out another patch to address feature bypass issues that continue to haunt its Windows SmartScreen tool and major updates to fix remote code execution and privilege escalation issues in Windows Pragmatic General Multicast (PGM) and Windows HMAC Key Derivation components.

The PGM flaw (CVE-2023-36397) carries a CVSS severity score of 9.8 out of 10 and should be considered a patch for high-priority deployment.

Microsoft’s patches follow Adobe’s rollout of a massive batch of security fixes to cover critical-severity flaws in its Acrobat and Reader, ColdFusion, inDesign, inCopy and Audition products.

Adobe documented 72 distinct security bugs and called special attention to code-execution defects in the widely deployed Adobe Acrobat and Reader software.

In a critical-severity bulletin, Adobe documented at least 17 Acrobat and Reader bugs that expose unpatched Windows and macOS systems to arbitrary code execution and memory leak issues. 

Adobe also issued patches for at least six distinct ColdFusion flaws that could lead to arbitrary code execution and security feature bypass. The ColdFusion issues are flagged as critical and affects versions 2023 and 2021.   

Related: Two New Adobe ColdFusion Vulnerabilities Exploited in Attacks

Related: Microsoft Plugs Windows Hole Exploited in Ransomware Attacks

Related: Google Patches Chrome Zero-Day Reported by Spyware Hunters

Related: Patch Tuesday: Microsoft Warns of Exploited Windows Zero-Days

Related: Microsoft (Finally) Patches Exploited Office Zero-Days

https://www.securityweek.com/microsoft-warns-of-critical-bugs-being-exploited-in-the-wild/