Zoom Patches High-Risk Flaws in Meeting Connector, Keybase Client

Video messaging technology giant Zoom has shipped patches for high-severity vulnerabilities that expose enterprise users to remote code execution and command injection attacks.

The company released multiple security bulletins to warn of the risks and called special attention to a pair of “high-risk” bugs affecting its on-prem meeting connector software and the popular Keybase Client.

“The network proxy page on the web portal for the [affected] products fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator,” Zoom said in a note.

The CVE-2021-34417 carries a CVSS Base Score of 7.9, and affects multiple Zoom software components — Zoom On-Premise Meeting Connector Controller, Zoom On-Premise Meeting Connector MMR, Zoom On-Premise Recording Connector, Zoom On-Premise Virtual Room Connector.

[ READ: Vulnerability Allowed Attackers to Join Zoom Meetings ]

A second high-severity bulletin was also released with patches for CVE-2021-34422, a path traversal bug affecting Keybase Client for Windows.

From Zoom’s advisory:

“The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine.”

“If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client, this could lead to remote code execution.”

Zoom said the issue was fixed in the 5.7.0 Keybase Client for Windows release.

Zoom’s security response team also shipped patches for a medium-risk bug (CVE-2021-34420) in the Zoom Client for Meetings installer. “The Zoom Client for Meetings for Windows installer before version 5.5.4 does not properly verify the signature of files with .msi, .ps1, and .bat extensions. This could lead to a malicious actor installing malicious software on a customer’s computer,” the company warned.

The Zoom software does not have an automatic update mechanism. Users are urged to manually check for software updates within the Zoom client.

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a journalist and cybersecurity strategist with more than 20 years experience covering IT security and technology trends.
Ryan has built security engagement programs at major global brands, including Intel Corp., Bishop Fox and Kaspersky GReAT. He is a co-founder of Threatpost and the global SAS conference series. Ryan’s career as a journalist includes bylines at major technology publications including Ziff Davis eWEEK, CBS Interactive’s ZDNet, PCMag and PC World.
Ryan is a director of the Security Tinkerers non-profit, and a regular speaker at security conferences around the world.
Follow Ryan on Twitter @ryanaraine.

Previous Columns by Ryan Naraine:

Tags:

https://www.securityweek.com/zoom-patches-high-risk-flaws-meeting-connector-keybase-client

Researcher Shows Windows Flaw More Serious After Microsoft Releases Incomplete Patch

A researcher has discovered that a Windows vulnerability for which Microsoft released an incomplete patch in August is more serious than initially believed.

Tracked as CVE-2021-34484, the bug is described by Microsoft as a Windows User Profile Service elevation of privilege, and requires local, authenticated access for exploitation. All versions of Windows, including Windows Server, are affected.

The security error resides in the User Profile Service, affecting code designed for creating a temporary user profile folder when the original profile folder is damaged.

Microsoft’s incomplete patch for the issue could be easily bypassed with only a small change in the attacker script, security researcher Abdelhamid Naceri, who discovered the vulnerability, found out.

The security error appears to have a greater impact than Microsoft’s initial assessment of it, as it could allow an attacker logged in as a regular user to execute code with System privileges.

The researcher discovered it was possible to use symbolic links to target the process of copying folders and files from the original profile folder to the temporary folder, which allows an attacker to create attacker-writable folders within a system location, and then use them to launch system processes to execute code.

Microsoft’s fix checked whether a symbolic link was used for the destination folder, and aborted the operation if so. However, the incomplete fix would only check for the symbolic link in the uppermost folder, but not in other folders along the destination path.

An attacker looking to exploit the vulnerability needs to win a race condition and possibly to obtain additional user credentials than the ones they are logged-on with, but they would have an unlimited number of attempts to successfully complete an attack.

A new CVE identifier, CVE-2021-33742, was issued for the flaw, and it is considered a zero-day, given that technical information, along with proof-of-concept (POC) code, have been public since October 22.

ACROS Security’s 0patch service has released an unofficial fix, which extends the security check to the entire destination path of the temporary folder, and aborts the creation of a temporary user profile if any symbolic links are present.

The 0patch fix is available for free until Microsoft releases an official patch for the vulnerability.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/researcher-shows-windows-flaw-more-serious-after-microsoft-releases-incomplete-patch

Google, Adobe Announce New Open Source Security Tools

Google and Adobe this week announced the availability of new open source security tools, for continuous fuzzing and detecting living-off-the-land attacks.

Google releases ClusterFuzzLite

Google announced the open source release of ClusterFuzzLite, which it described as a ClusterFuzz-based continuous fuzzing solution that runs as part of continuous integration (CI) workflows in an effort to help users find vulnerabilities before they are committed to the source code.

ClusterFuzzLite can be integrated into CI workflows with only a few lines of code.

“With the release of ClusterFuzzLite, any project can integrate this essential testing standard and benefit from fuzzing,” Google said. “ClusterFuzzLite offers many of the same features as ClusterFuzz, such as continuous fuzzing, sanitizer support, corpus management, and coverage report generation. Most importantly, it’s easy to set up and works with closed source projects, making ClusterFuzzLite a convenient option for any developer who wants to fuzz their software.”

ClusterFuzzLite goes hand in hand with Google’s OSS-Fuzz open source fuzzing service, which has helped identify 6,500 vulnerabilities and 21,000 functional bugs across more than 500 open source projects.

Adobe releases LotL Classifier

Living-off-the-land (LotL) is used to describe attacks where malicious actors leverage legitimate software in an effort to avoid being detected.

Adobe has released an open source tool, named LotL Classifier, that is designed to detect LotL attacks by leveraging a “feature extraction” component and a machine learning-based classifier algorithm.

The feature extraction component takes data from threat intelligence, malware analysis, real incidents and real data logs, and uses that data to generate a series of tags based on binaries, paths, keywords, networks, patterns, and similarity.

The tags are then fed to the classifier component, which decides if the analyzed data set is good or bad. This component also creates a set of tags that can be integrated with rule-based automation or anomaly detection tools, such as One Stop Anomaly Shop (OSAS), which Adobe recently released as open source.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

https://www.securityweek.com/google-adobe-announce-new-open-source-security-tools

macOS Zero-Day Exploited to Deliver Malware to Users in Hong Kong

Google on Thursday shared details about a recent attack that exploited a zero-day vulnerability in macOS to deliver malware to users in Hong Kong.

According to Google, the attack, discovered in late August, was likely conducted by a well-resourced state-sponsored threat group which, based on the quality of their code, had access to their own software engineering team.

While Google has not named any country, users in Hong Kong have been typically targeted by threat actors sponsored by China.

The watering hole involved the websites of a media outlet and an important pro-democracy labor and political group in Hong Kong. The sites hosted two iframes that served iOS and macOS exploits.

In the case of the iOS exploit, Google researchers could not obtain the full exploit chain, but they did discover that it involved a framework based on the Ironsquirrel browser exploit delivery project and exploitation of an older remote code execution vulnerability tracked as CVE-2019-8506.

The macOS exploit, however, leveraged a remote code execution vulnerability in WebKit — tracked as CVE-2021-1789 and patched by Apple in January — and a privilege escalation flaw that was only patched by Apple on September 23, roughly one month after Google spotted the attack.

When it patched the zero-day, tracked as CVE-2021-30869, Apple warned that it had been exploited in attacks. The security hole is a type confusion in XNU, the OS kernel used by both iOS and macOS, and it can be exploited to execute arbitrary code with kernel privileges.

When Google analyzed the macOS exploits, a parameter set up by the attackers to record the number of exploitation attempts had a value of roughly 200.

The Mac malware delivered in the attack can capture keystrokes, take screenshots, fingerprint compromised devices, upload and download files, execute terminal commands, and record audio.

Security researcher Patrick Wardle has published a blog post detailing the malware, which he has named OSX.CDDS — the name CDDS comes from a string format related to the malware’s features.

The malware sample analyzed by Wardle had not been detected by any of the antivirus engines on the VirusTotal malware analysis service.

Previous Columns by Eduard Kovacs:

Tags:

https://www.securityweek.com/macos-zero-day-exploited-deliver-malware-users-hong-kong

U.S. Gov Announces Support for ‘Paris Call’ Cybersecurity Effort

United States Vice President Kamala Harris on Wednesday formally announced support for the Paris Call for Trust and Security in Cyberspace, an international collaborative initiative aimed at advancing cybersecurity.

Issued in 2018, the Paris Call details nine principles to improve stability in cyberspace through global collaboration, and has been already signed by 79 countries.

The principles promoted by the Call include:

Protecting individuals and infrastructure
Protecting against activity that affects the availability of the Internet
Protecting the electoral process
Protecting intellectual property
Preventing the proliferation of malware and nefarious practices
Improving the security of digital processes, products and services
Strengthening an advanced cyber hygiene
Preventing non-state actors from hacking back
Promoting international norms in cyberspace

Through supporting the Call, the United States said it will commit to advancing cybersecurity and preserving an open and reliable Internet.

Vice President Harris said the U.S. will work with France and other countries, as well as with private companies and civil society globally to promote responsible behavior in cyberspace.

“This includes working with like minded countries to attribute and hold accountable States that engage in destructive, disruptive, and destabilizing cyber activity,” according to a White House statement.

The decision to support the Call falls in line with the U.S. government’s current effort to improve cybersecurity for both individuals and businesses and to accelerate international cooperation to combat cybercrime.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/us-gov-announces-support-paris-call-cybersecurity-effort

Nearly 100 TCP/IP Stack Vulnerabilities Found During 18-Month Research Project

An 18-month research project has resulted in the discovery of nearly 100 vulnerabilities across more than a dozen TCP/IP stacks.

The research, named Project Memoria, was conducted by enterprise device security firm Forescout in collaboration with others. It resulted in the discovery of the vulnerabilities tracked as Ripple20, AMNESIA:33, NUMBER:JACK, NAME:WRECK, INFRA:HALT, and NUCLEUS:13.

TCP/IP stacks are leveraged by a wide range of devices for communication, including medical products, industrial control systems (ICS), printers, and switches.

Researchers have identified a total of 97 vulnerabilities across 14 TCP/IP stacks, including ones that can be exploited for remote code execution, DoS attacks, or to obtain sensitive information. The flaws impact hundreds of products, with researchers estimating that there are roughly 3 billion vulnerable devices.

TCP/IP stack vulnerabilities

Project Memoria targeted a total of 15 TCP/IP stacks, including CycloneTCP, FNET, FreeBSD, IPnet, lwIP, MPLAB Net, NetX, NicheStack, NDKTCPIP, Nucleus NET, Nut/Net, picoTCP, Treck, uC/TCP-IP, and uIP. In only one of them, lwIP, researchers haven’t found any vulnerabilities.

Some of these TCP/IP stacks have been around for nearly 30 years, but they are still actively developed. While their developers continue to release patches for vulnerabilities, those patches often don’t make it to end user devices, in large part due to what researchers describe as “silent patching.” Silent patching refers to some developers fixing vulnerabilities without assigning CVE identifiers, which results in device vendors and their customers not knowing about the flaws.

“[Silently patched vulnerabilities] exist in very critical supply-chain software, so there are millions of devices out there that have been vulnerable for a long time without even their vendors knowing about it because other vendors chose to remain silent,” Forescout said in a report summarizing Project Memoria. “Silently patching a vulnerability does not mean that nobody will get to know about it: these issues tend to be rediscovered again and again.”

While silent patching can be problematic, some vendors don’t respond or fail to take action when notified about vulnerabilities. Forescout has identified 422 device vendors whose products could be vulnerable. However, only 81 of them have issued advisories and of the 36 that have confirmed being impacted 10 said they will not provide patches.

“This means that only 19% of potentially affected vendors have provided some public response and only 5.5% have actually patched the vulnerabilities,” Forescout said.

An analysis of a quarter of a million devices affected by the Project Memoria vulnerabilities showed that the highest number of vulnerable systems are housed by the government and healthcare sectors, followed by manufacturing, retail, and financial.

The most common types of vulnerable devices are printers, VoIP products, industrial controllers, storage systems, and networking devices. In the case of healthcare organizations, infusion pumps and building automation systems are often impacted.

“The main conclusion of Project Memoria is that supply-chain vulnerabilities are here to stay but mitigation is possible, as long as both the security community and individual organizations take action,” Forescout concluded.

Previous Columns by Eduard Kovacs:

Tags:

https://www.securityweek.com/nearly-100-tcpip-stack-vulnerabilities-found-during-18-month-research-project

Contrast Security Raises $150 Million at ‘Unicorn’ Valuation

Code security company Contrast Security this week announced that it has closed $150 million Series E funding round at a billion-dollar valuation, making the company the latest cybersecurity unicorn.

The company offers a platform that helps developers create more secure applications by discovering vulnerabilities in code, detecting what libraries are being used, and goes as far as providing embedded runtime exploit prevention that analyzes application runtime to prevents and confirm exploitability of bugs.

Contrast says the investment will help it meet demand for its platform and that it will use the funds to accelerate global expansion plans, to further gain market share. The new infusion of cash will also help the company “execute on strategic opportunities and acquisitions.”

According to Contrast, its solutions secure code for numerous large organizations worldwide, including American Red Cross, AXA, BMW, DocuSign, SOMPO Japan, and Zurich, along with other global Fortune 500 enterprises.

Founded in 2014 and headquartered in Los Altos, California, Contrast provides customers with an Application Security Platform designed to help secure code faster through identifying vulnerabilities and providing context-specific guidance on how to address them.

The funding round was led by Liberty Strategic Capital, with existing investors Acero Capital, AXA Venture Partners, Battery Ventures, General Catalyst, Microsoft’s M-12 Fund, and Warburg Pincus, contributing as well.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/contrast-security-raises-150-million-unicorn-valuation

Remote Code Execution Flaw in Palo Alto GlobalProtect VPN

Palo Alto remote code execution flaw

Cybersecurity vendor Palo Alto Networks is calling urgent attention to a remote code execution vulnerability in its GlobalProtect portal and gateway interfaces, warning that it’s easy to launch network-based exploits with root privileges.

The Santa Clara, Calif.-based Palo Alto Networks said the security defect can be exploited to allow an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges.

The company slapped a critical-severity rating on the CVE-2021-3064 vulnerability and noted that an attacker must have network access to the GlobalProtect interface to exploit this issue.

Palo Alto said the issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.17. High-priority patches have been issued for enterprise customers running PAN-OS 8.1.17 and all later PAN-OS versions.

The company said it was not aware of any malicious exploitation of this issue but confirmed that attack surface management firm Randori had fitted successful exploits into its red-teaming software product.

[ READ: Zero-Days Under Attack: Microsoft Plugs Exchange Server, Excel Holes ]

According to a vulnerability report from the Randori Attack Team, the vulnerability affects PAN firewalls using the GlobalProtect Portal VPN and allows for unauthenticated remote code execution on vulnerable installations of the product.

“Our team was able to gain a shell on the affected target, access sensitive configuration data, extract credentials, and more. Once an attacker has control over the firewall, they will have visibility into the internal network and can proceed to move laterally,” Randori said.

The company is withholding technical details on the vulnerability for 30 days to allow Palo Alto Networks customers to apply available fixes.

Previous Columns by Ryan Naraine:

Tags:

https://www.securityweek.com/remote-code-execution-flaw-palo-alto-globalprotect-vpn

VMware Working on Patches for Serious vCenter Server Vulnerability

VMware announced on Wednesday that it’s working on patches for a potentially serious privilege escalation vulnerability affecting vCenter Server.

The vulnerability is tracked as CVE-2021-22048 and it has been assigned an “important” severity rating, which is equivalent to “high severity” based on its CVSS score of 7.1.

“The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism,” VMware said in its advisory. “A malicious actor with non-administrative access to vCenter Server may exploit this issue to elevate privileges to a higher privileged group.”

The vulnerability impacts vCenter Server 6.7 and 7.0, as well as Cloud Foundation 3.x and 4.x. Until patches become available, VMware has published a document with workaround instructions.

“Workaround for CVE-2021-22048 is to switch to AD over LDAPS authentication/Identity Provider Federation for AD FS (vSphere 7.0 only) from Integrated Windows Authentication (IWA),” the virtualization giant explained.

Yaron Zinar and Sagi Sheinfeld of CrowdStrike have been credited for reporting the issue to VMware.

There is no mention of the vulnerability being exploited for malicious purposes, but the lack of patches and the fact that the security hole was reported by CrowdStrike could suggest that it has been exploited.

SecurityWeek has reached out to CrowdStrike, but the cybersecurity firm has declined to share any additional information.

Threat actors exploiting vCenter Server vulnerabilities is not unheard of so it’s important that organizations deploy patches or workarounds as soon as possible. There are several thousand instances of vCenter Server that are exposed to the internet.

Previous Columns by Eduard Kovacs:

Tags:

https://www.securityweek.com/vmware-working-patches-serious-vcenter-server-vulnerability

Critical Flaw in WordPress Plugin Leads to Database Wipe

A major security vulnerability in the WP Reset PRO WordPress plugin could be exploited by an authenticated user to wipe the entire database of a website, according to a warning from researchers at Packstack (formerly WebARX).

The issue can be exploited by any authenticated user, regardless of their authorization, to wipe all tables in a WordPress installation’s database.

This would trigger the restart of the WordPress installation process. An attacker could abuse this to create an administrator account onto the WordPress website (an admin account must be created to complete the installation process), according to a Patchstack advisory.

An attacker could further exploit the newly created account to upload malicious plugins to the website, or even install trojan backdoors.

[ READ: WordPress 5.8.1 Patches Several Vulnerabilities ]

WP Reset PRO aims to help site administrators to easily reset a website’s database to the default installation while leaving files intact, to restore damaged sites, and remove customizations or parts of the site.

WP Reset PRO registers a few actions in the admin_action_* scope, including table deletion operation, but no check is performed to learn whether the user is indeed authorized to perform such an action, and because a nonce token to prevent CSRF attacks isn’t validated or checked.

Because of this vulnerability, “someone could simply visit the homepage of the site to start the WordPress installation process,” Patchstack warned.

WebFactory Ltd, which develops both the WP Reset and its PRO version, addressed the issue in version 5.99 of the plugin, by adding an authentication and authorization check, along with a check for a valid nonce token.

“It’s quite a destructive vulnerability, quite a problem for e-commerce and other sites that have open registration,” Patchstack CEO Oliver Sild told SecurityWeek.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

https://www.securityweek.com/critical-flaw-wordpress-plugin-leads-database-wipe