Cisco Patches Critical Vulnerability in BroadWorks Platform

Cisco on Wednesday announced patches for a critical-severity vulnerability in the BroadWorks Application Delivery Platform and BroadWorks Xtended Services Platform.

Tracked as CVE-2023-20238, the vulnerability affecting the BroadWorks calling and collaboration platform was identified in the single sign-on (SSO) implementation and could be exploited by remote, unauthenticated attackers to forge credentials and access affected systems.

“This vulnerability is due to the method used to validate SSO tokens. An attacker could exploit this vulnerability by authenticating to the application with forged credentials. A successful exploit could allow the attacker to commit toll fraud or to execute commands at the privilege level of the forged account,” Cisco explains in an advisory.

The tech giant notes that the attacker would need a valid user ID associated with the affected BroadWorks system to exploit the flaw. Despite this condition, the vulnerability has a CVSS score of 10.0.

The issue, Cisco says, impacts affected BroadWorks releases running AuthenticationService, BWCallCenter, BWReceptionist, CustomMediaFilesRetrieval, ModeratorClientApp, PublicECLQuery, PublicReporting, UCAPI, Xsi-Actions, Xsi-Events, Xsi-MMTel, or Xsi-VTR.

Cisco BroadWorks Application Delivery Platform and BroadWorks Xtended Services Platform version AP.platform.23.0.1075.ap385341 resolves the vulnerability. Cisco also announced independent releases 2023.06_1.333 and 2023.07_1.332 that contain the necessary patches.

On Wednesday, Cisco also released patches for a high-severity denial-of-service (DoS) vulnerability in the Identity Services Engine (ISE).

Advertisement. Scroll to continue reading.

Tracked as CVE-2023-20243, the issue exists because certain RADIUS accounting requests are not handled properly. An attacker sending crafted requests to a network access device that uses Cisco ISE directly could cause the RADIUS process to restart, denying user access to the network or service.

The vulnerability impacts Cisco ISE versions 3.1 and 3.2 only and was addressed with the release of Cisco ISE versions 3.1P7 and 3.2P3.

The tech giant says it is not aware of any of these vulnerabilities being exploited in malicious attacks.

Additional information can be found on Cisco’s product security page.

https://www.securityweek.com/cisco-patches-critical-vulnerability-in-broadworks-platform/

Chrome 116 Update Patches High-Severity Vulnerabilities

Google on Tuesday announced the release of a Chrome 116 update that patches four high-severity vulnerabilities reported by external researchers.

Tracked as CVE-2023-4761, the first bug is described as an out-of-bounds memory access issue in the FedCM (Federated Credential Management) API.

Out-of-bounds memory access errors occur when a program reads memory addresses outside of the bounds of a buffer, which could ultimately allow an attacker to cause a denial-of-service (DoS) condition or exploit additional weaknesses to achieve code execution.

The second flaw is a type confusion issue in the V8 JavaScript engine. Tracked as CVE-2023-4762, the vulnerability could lead to out-of-bounds memory access.

The third bug, CVE-2023-4763, is a use-after-free issue in Chrome’s Networks component, Google’s advisory reads.

A type of memory corruption bugs, use-after-free issues can be exploited to execute arbitrary code or cause a DoS condition and, if combined with other vulnerabilities, could lead to full system compromise.

In Chrome, use-after-free flaws can be combined with bugs in the browser process or with issues in the underlying operating system to escape Chrome’s sandbox.

Advertisement. Scroll to continue reading.

The fourth vulnerability patched with this Chrome 116 update is CVE-2023-4764, an incorrect security UI flaw in BFCache (the in-memory cache where a complete snapshot of a page is stored), allowing a remote attacker to use a crafted HTML page to spoof the contents of the URL bar (Omnibox).

Google has yet to determine the bug bounty rewards the reporting researchers will receive for their findings.

The latest Chrome iteration is now rolling out as version 116.0.5845.179 for macOS and Linux and as versions 116.0.5845.179/.180 for Windows.

The internet giant also announced that the Chrome Extended Stable channel was updated to version 116.0.5845.179 for macOS and to version 116.0.5845.180 for Windows.

Google makes no mention of any of these vulnerabilities being exploited in malicious attacks.

https://www.securityweek.com/chrome-116-update-patches-high-severity-vulnerabilities/

AtlasVPN to Patch IP Leak Vulnerability After Public Disclosure

AtlasVPN developers are working on a patch for an IP leak vulnerability whose details were made public by a researcher who decided to take the full disclosure route after responsible disclosure attempts were ignored.

The researcher, who apparently wants to remain anonymous, shared the details on the Full Disclosure mailing list and on Reddit, claiming that he had unsuccessfully attempted to contact AtlasVPN support in an effort to find a security contact or an official channel for reporting the vulnerability.

The security hole impacts the AtlasVPN Linux client and it can be exploited by luring the targeted user to a website hosting the exploit code.

The exploit causes AtlasVPN to disconnect, which results in the user’s real IP address being leaked to the attacker’s website.

“The AtlasVPN Linux Client consists of two parts. A daemon (atlasvpnd) that manages the connections and a client (atlasvpn) that the user controls to connect, disconnect and list services. The client does not connect via a local socket or any other secure means but instead it opens an API on localhost on port 8076,” the researcher explained.

“It does not have ANY authentication. This port can be accessed by ANY program running on the computer, including the browser. A malicious javascript on ANY website can therefore craft a request to that port and disconnect the VPN,” the researcher added.

The exploit code has been made public and it’s not difficult to use for malicious purposes. An attacker simply needs to upload it to a site they control.

Advertisement. Scroll to continue reading.

After the findings were made public and AtlasVPN was contacted for comment by SecurityWeek, the company apologized for its slow reaction and promised to improve its vulnerability reporting process.

AtlasVPN told SecurityWeek in an emailed statement that it does take security and user privacy seriously and it’s actively working on a patch. Impacted users will be prompted to update their Linux app to the latest version as soon as the fix becomes available.

“The vulnerability affects Atlas VPN Linux client version 1.0.3. As the researcher stated, due to the vulnerability, the application and, hence, encrypted traffic between a user and the VPN gateway can be disconnected by a malicious actor. This could lead to the user’s IP address disclosure,” AtlasVPN said.

“We greatly appreciate the cybersecurity researchers’ vital role in identifying and addressing security flaws in systems, which helps safeguard against potential cyberattacks, and we thank them for bringing this vulnerability to our attention. We will implement more security checks in the development process to avoid such vulnerabilities in the future. Should anyone come across any other potential threats related to our service, please contact us via security(at)atlasvpn.com,” it added.

https://www.securityweek.com/atlasvpn-to-patch-ip-leak-vulnerability-after-public-disclosure/

Exploit Code Published for Critical-Severity VMware Security Defect

Just days after shipping a major security update to correct vulnerabilities in its Aria Operations for Networks product line, VMWare is warning that exploit code has been published online.

In an updated advisory, the virtualization technology giant confirmed the public release of exploit code that provides a roadmap for hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line interface.

The exploit code and root-cause analysis, released by SinSinology researcher Sina Kheirkhah, documents the problem as a case where VMWare “forgot to regenerate” SSH keys.

He pointed to VMWare’s CVE-2023-34039 advisory (CVSS severity score of 9.8 out of 10) that describes the bug as a network authentication bypass and warns that the issue is being mischaracterized.

“Interestingly, VMware has named this issue “Networks Authentication Bypass”, but in my opinion, nothing is getting bypassed. There is SSH authentication in place; however, VMware forgot to regenerate the keys,” Kheirkha said.

“After reading both descriptions, I realized that this must be a hardcoded SSH key issue,” he said, noting that VMware’s Aria Operations for Networks had hardcoded its keys from version 6.0 to 6.10.

“The main challenge in exploiting this vulnerability is that each version of VMware’s Aria Operations for Networks has a unique SSH key. To create a fully functional exploit, I had to collect all the keys from different versions of this product,” he said.

Advertisement. Scroll to continue reading.

The release of exploit code for this flaw amplifies the urgency for network admins to apply the available patches from VMWare.

The VMware Aria Operations for Networks product, formerly vRealize Network Insight, is used by businesses to monitor, discover and analyze networks and applications to build secure network infrastructure across clouds.

VMware has struggled with security problems in the Aria Operations for Networks product, recently patching a gaping command injection flaw that was remotely exploited in the wild. The Aria Operations for Network product has also been tagged in the U.S. government’s CISA Known Exploited Vulnerabilities catalog.

https://www.securityweek.com/exploit-code-published-for-critical-severity-vmware-security-defect/

In Other News: Hacking Encrypted Linux Computers, Android Fuzzing, Skype Leaking IPs

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar.

We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.

Here are this week’s stories:

Quickly hitting Enter key to hack an encrypted Linux computer

Researchers at Pulse Security discovered that an attacker who has physical access to an encrypted Linux system can gain local root access to the computer — bypassing full-disk encryption — by quickly hitting Enter on the keyboard or using a special device to simulate the process. These types of attacks are not new.

High-severity vulnerability patched in Chrome

Advertisement. Scroll to continue reading.

A new Chrome 116 update patches a high-severity use-after-free vulnerability. These types of flaws can typically be combined with other bugs for sandbox escapes and remote code execution. The bug bounty for the vulnerability has yet to be determined by Google.

Google details Android fuzzing efforts

Google has published a blog post detailing its Android fuzzing efforts, including how it finds vulnerabilities, why it continues to invest in fuzzing, challenges, and how others can contribute.

Top-level domains and DNS issues

Cisco Talos has conducted research into top-level domain (TLDs) and DNS issues, highlighting potential risks related to the .kids TLD, ‘zombified’ DNS name issues related to various country TLDs, as well as problems with second-level TLDs.

Skype mobile app is leaking IP addresses

The Skype mobile application is leaking IP addresses, according to a report from 404 Media. A hacker can obtain a targeted user’s IP by sending them a link over Skype — the victim does not have to interact with the link. Microsoft has been notified, but the company is not rushing to patch it.

Rackspace says cost of ransomware attack remediation tops $10 million (so far)

After being hit by a ransomware attack in December 2022, cloud computing company Rackspace said in a recent earnings presentation that it has spent $10.8 million so far responding to the incident that impacted its hosted Exchange infrastructure, forcing it to sunset the offering. The company said it expects to continue to incur legal and other professional services costs in future periods.

University of Michigan cyberattack

The University of Michigan has been targeted in a cyberattack that resulted in significant disruptions to its systems, as well as internet outages. The university has not shared any information on the attack itself, citing an ongoing investigation.

CISA and FBI release QakBot infrastructure indicators of compromise (IOCs)

CISA and the FBI have released IoCs associated with the recently disrupted QakBot botnet infrastructure. The botnet was targeted as part of an international law enforcement operation that involved the distribution of a utility designed to automatically remove the malware from infected systems.

Classiscam cybercrime groups made millions by scamming users worldwide

Group-IB has a report on Classiscam, a scam operation that has allowed hundreds of cybercrime groups to make nearly $65 million by targeting individuals across 79 countries, tricking them into sending money for inexistent goods sold online. An automated scam-as-a-service program has made it easier for scammers to conduct their activities.

Malwarebytes laying off 100 employees

Cybersecurity firm Malwarebytes has laid off 100 employees as it prepares to separate its consumer- and enterprise-focused business units. Last year, the company terminated 14% of its staff (roughly 125 people).

https://www.securityweek.com/in-other-news-hacking-encrypted-linux-computers-android-fuzzing-skype-leaking-ips/

Vulnerability in WordPress Migration Plugin Exposes Websites to Attacks

A vulnerability in several extensions for the All-in-One WP Migration plugin potentially exposes WordPress websites to attacks leading to sensitive information disclosure.

With more than five million installations and maintained by ServMask, All-in-One WP Migration is a highly popular plugin for moving websites that also provides several premium extensions for migrating to third-party platforms.

On Wednesday, WordPress security firm Patchstack shared details on a vulnerability impacting All-in-One WP Migration’s Box, Google Drive, OneDrive, and Dropbox extensions that could allow attackers to access sensitive information.

Tracked as CVE-2023-40004 and described as an unauthenticated access token manipulation issue, the bug could allow an unauthenticated attacker to tamper with the access token configuration of the affected extension.

“This access token manipulation could result in a potential sensitive information disclosure of migration to the attacker’s controlled third-party account or restore a malicious backup,” Patchstack says.

The flaw was identified in the init function of the affected extensions, which is “hooked to the WordPress’s admin_init hook”, which in turn can be triggered by an attacker, without authentication.

“Since there is no permission and nonce validation on the init function, an unauthenticated user is able to modify or delete the access token used on each of the affected extensions,” Patchstack explains.

Advertisement. Scroll to continue reading.

On July 18, the WordPress security firm reported the vulnerability to ServMask, which patched the bug in all impacted extensions by “adding permission and nonce validation on the init function”.

Users are advised to update to All-in-One WP Migration’s Box extension version 1.54, Google Drive extension version 2.80, OneDrive extension version 1.67, and Dropbox extension version 3.76, which were released at the end of July.

https://www.securityweek.com/vulnerability-in-wordpress-migration-plugin-exposes-websites-to-attacks/

Splunk Patches High-Severity Flaws in Enterprise, IT Service Intelligence

Splunk on Wednesday announced patches for multiple high-severity vulnerabilities in Splunk Enterprise and IT Service Intelligence, including flaws in third-party packages.

The most severe of the bugs resolved in Splunk Enterprise this month is CVE-2023-40595 (CVSS score of 8.8), which is described as a remote code execution issue exploitable using crafted queries.

“The exploit requires the use of the collect SPL command which writes a file within the Splunk Enterprise installation. The attacker can then use this file to submit a serialized payload that can result in execution of code within the payload,” Splunk explains in an a d visory.

Next in line is CVE-2023-40598, a command injection vulnerability impacting a legacy internal function, which could be exploited to execute arbitrary code.

“The vulnerability revolves around the currently-deprecated runshellscript command that scripted alert actions use. This command, along with external command lookups, lets an attacker use this vulnerability to inject and execute commands within a privileged context from the Splunk platform instance,” Splunk explains.

The latest Splunk Enterprise releases also resolve a cross-site scripting (XSS) flaw (CVE-2023-40592), an absolute path traversal bug leading to code execution (CVE-2023-40597), and a privilege escalation issue resulting from an insecure path reference in a DLL (CVE-2023-40596).

All vulnerabilities were addressed with the release of Splunk Enterprise versions 8.2.12, 9.0.6, and 9.1.1, which also patch two medium-severity denial-of-service (DoS) flaws.

Advertisement. Scroll to continue reading.

On Wednesday, Splunk also announced patches for an unauthenticated log injection bug (CVE-2023-4571, CVSS score of 8.6) in IT Service Intelligence.

The issue allows an attacker to inject ANSI escape codes into log files, resulting in malicious code being executed when the log file is read in a vulnerable terminal application.

While IT Service Intelligence is not directly impacted by the flaw, indirect impact results from the permissions the terminal application has, and from where and how the user reads the malicious log files.

Splunk patched the vulnerability in IT Service Intelligence versions 4.13.3 and 4.15.3.

The software company makes no mention of any of these vulnerabilities being exploited in attacks. Additional information on the bugs can be found on Splunk’s security advisories page.

The updates Splunk announced on Wednesday also resolve multiple high-severity issues in third-party packages used in Splunk Enterprise, IT Service Intelligence, and Universal Forwarder.

https://www.securityweek.com/splunk-patches-high-severity-flaws-in-enterprise-it-service-intelligence/

Recent Juniper Flaws Chained in Attacks Following PoC Exploit Publication

Threat actors have started exploiting four recently patched vulnerabilities in the J-Web component of Juniper Networks’ Junos OS after proof-of-concept (PoC) exploit code was published online.

The issues, tracked as CVE-2023-36844 through CVE-2023-36847, are medium-severity bugs that can be exploited to control environment variables remotely and to upload arbitrary files, without authentication.

Juniper Networks released patches for these vulnerabilities ten days ago, warning that an attacker could chain them to achieve remote code execution and rating the chained exploitation as ‘critical severity’.

The bugs, the networking appliances maker says, impact the SRX series firewalls and EX series switches running Junos OS versions prior to 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, and 23.2R1.

According to non-profit cybersecurity organization Shadowserver Foundation, exploitation of these vulnerabilities started on August 25, the same day that PoC exploit code was published.

“Since 25th August we are seeing exploitation attempts from multiple IPs for Juniper J-Web CVE-2023-36844 (& friends) targeting /webauth_operation.php endpoint. Same day an exploit POC was published. This involves combining lower severity CVEs to achieve pre-auth RCE,” Shadowserver says.

Shadowserver tracks roughly 8,200 instances of exposed J-Web interfaces, most of them located in Asia (5,170), followed by North America (1,292) and Europe (1,018). It has observed more than 3,300 events related to the exploitation of these flaws.

Advertisement. Scroll to continue reading.

The attacks appear to be related to the PoC exploit that attack surface management firm WatchTowr published on August 25 alongside a technical analysis of two of these vulnerabilities – namely CVE-2023-36846 and CVE-2023-36847.

Pointing out that the exploitation of these flaws is trivial, the cybersecurity firm urged administrators to update the affected firewalls and switches to the latest available firmware releases and to check the PHP log files on their appliances for specific error messages that could indicate intrusion attempts.

“Given the simplicity of exploitation, and the privileged position that JunOS devices hold in a network, we would not be surprised to see large-scale exploitation,” WatchTowr warned.

https://www.securityweek.com/recent-juniper-flaws-chained-in-attacks-following-poc-exploit-publication/

High-Severity Memory Corruption Vulnerabilities Patched in Firefox, Chrome

Mozilla and Google on Tuesday announced the release of stable updates for Firefox and Chrome to address several high-severity vulnerabilities, including memory corruption issues.

Mozilla released Firefox 117 with patches for 13 vulnerabilities, including seven rated ‘high severity’, four of which are described as memory corruption bugs affecting the browser’s IPC CanvasTranslator, IPC ColorPickerShownCallback, IPC FilePickerShownCallback, and JIT UpdateRegExpStatics components.

Reported by the same security researcher (known as sonakkbi) and tracked as CVE-2023-4573, CVE-2023-4574, and CVE-2023-4575 the first three flaws “could have led to a use-after-free causing a potentially exploitable crash,” Mozilla explains in its advisory.

Tracked as CVE-2023-4577, the fourth vulnerability could have led to a potentially exploitable crash as well.

Mozilla also patched a high-severity integer overflow (CVE-2023-4576) in the RecordedSourceSurfaceCreation component of Firefox for Windows, resulting in “a heap buffer overflow potentially leaking sensitive data that could have led to a sandbox escape”.

Firefox 117 also addresses multiple high-severity memory safety bugs that are collectively tracked as CVE-2023-4584 and CVE-2023-4585 and which also impact Firefox ESR and Thunderbird.

The remaining six issues addressed with this browser release are medium- and low-severity vulnerabilities that could lead to site spoofing, sensitive information leaks, the download of files without a warning of their potential harm, a buffer overflow, or browser context not being cleared when closing a private window.

Advertisement. Scroll to continue reading.

On Tuesday, the browser maker also announced the release of Firefox ESR 115.2 with patches for 14 vulnerabilities, including 12 resolved in Firefox 117. Additionally, Mozilla released Firefox ESR 102.15 with patches for six vulnerabilities.

More information on these vulnerabilities can be found on Mozilla’s security advi sories page.

Google on Tuesday released its second weekly update for Chrome, now rolling out as version 116.0.5845.140 for macOS and Linux and as versions 116.0.5845.140/.141 for Windows.

The Chrome update resolves one vulnerability, tracked as CVE-2023-4572 and described as a use-after-free flaw in MediaStream. Such issues may often be exploited to escape Chrome’s sandbox and achieve remote code execution, if combined with other vulnerabilities.

Mozilla and Google make no mention of any of these flaws being exploited in attacks.

https://www.securityweek.com/high-severity-memory-corruption-vulnerabilities-patched-in-firefox-chrome/

VMware Patches Major Security Flaws in Network Monitoring Product

Virtualization technology giant VMware on Tuesday shipped a major security update to correct at least two critical vulnerabilities in its Aria Operations for Networks product line.

In a critical-severity advisory, VMware said the flaws could be exploited by malicious hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line interface.

VMware tagged the network authentication bypass issue as CVE-2023-34039 and applied a CVSS severity score of 9.8 out of 10.

“Aria Operations for Networks contains an authentication bypass vulnerability due to a lack of unique cryptographic key generation. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8,” the company said.

The VMware Aria Operations for Networks product, formerly vRealize Network Insight, is used by enterprises to monitor, discover and analyze networks and applications to build secure network infrastructure across clouds.

The company said the Aria Operations for Networks collectors are impacted by the vulnerability but advised customers that upgrading the platform appliance will remediate the issue.

VMware also shipped a patch for a second bug — CVE-2023-20890 — that allows an authenticated malicious actor with administrative access to VMware Aria Operations for Networks to write files to arbitrary locations.

Advertisement. Scroll to continue reading.

VMware has struggled with security problems in the Aria Operations for Networks product, recently patching a gaping command injection flaw that was remotely exploited in the wild.

The Aria Operations for Network product has been tagged in the U.S. government’s CISA Known Exploited Vulnerabilities catalog.

https://www.securityweek.com/vmware-patches-major-security-flaws-in-network-monitoring-product/