EDX-Explorer

Vendors are reacting Vulnerability-related.DiscoverVulnerability swiftly to a vulnerability that lets attackers eavesdrop on your network traffic . Monday morning was not a great time to be an IT admin , with the public release Vulnerability-related.DiscoverVulnerability of a bug that effectively broke WPA2 wireless security . As reported Vulnerability-related.DiscoverVulnerability previously by ZDNet , the bug , dubbed `` KRACK '' -- which stands for Key Reinstallation Attack -- is at heart a fundamental flaw in the way Wi-Fi Protected Access II ( WPA2 ) operates . The security protocol , an upgrade from WEP , is used to protect and secure communications between everything from our routers , mobile devices , and Internet of Things ( IoT ) devices , but there is an issue in the system 's four-way handshake that permits devices with a pre-shared password to join a network . According to security researcher and academic Mathy Vanhoef , who discovered Vulnerability-related.DiscoverVulnerability the flaw , threat actors can leverage the vulnerability to decrypt traffic , hijack connections , perform man-in-the-middle attacks , and eavesdrop on communication sent from a WPA2-enabled device . US-CERT has known Vulnerability-related.DiscoverVulnerability of the bug for some months and informed Vulnerability-related.DiscoverVulnerability vendors ahead of the public disclosure Vulnerability-related.DiscoverVulnerability to give them time to prepare Vulnerability-related.PatchVulnerability patches and prevent Vulnerability-related.PatchVulnerability the vulnerability from being exploited Vulnerability-related.DiscoverVulnerability in the wild -- of which there are no current reports Vulnerability-related.DiscoverVulnerability of this bug being harnessed by cyberattackers . The bug is present in Vulnerability-related.DiscoverVulnerability WPA2 's cryptographic nonce and can be utilized to dupe a connected party into reinstalling a key which is already in use . While the nonce is meant to prevent replay attacks , in this case , attackers are then given the opportunity to replay , decrypt , or forge packets . In general , Windows and newer versions of iOS are unaffected Vulnerability-related.DiscoverVulnerability , but the bug can have a serious impact on Vulnerability-related.DiscoverVulnerability Android 6.0 Marshmallow and newer . The attack could also be devastating for IoT devices , as vendors often fail to implement acceptable security standards or update systems in the supply chain , which has already led to millions of vulnerable and unpatched IoT devices being exposed for use by botnets . The vulnerability does not mean the world of WPA2 has come crumbling down , but it is up to vendors to mitigate Vulnerability-related.PatchVulnerability the issues this may cause . In total , ten CVE numbers have been preserved to describe Vulnerability-related.DiscoverVulnerability the vulnerability and its impact Vulnerability-related.DiscoverVulnerability , and according to the US Department of Homeland Security ( DHS ) , the main affected vendors are Aruba , Cisco , Espressif Systems , Fortinet , the FreeBSD Project , HostAP , Intel , Juniper Networks , Microchip Technology , Red Hat , Samsung , various units of Toshiba and Ubiquiti Networks .

Adobe on Wednesday released Vulnerability-related.PatchVulnerability several unscheduled fixes for Flash Player , including a critical vulnerability that it said is being exploited Vulnerability-related.DiscoverVulnerability in the wild . The critical vulnerability , CVE-2018-15982 , is a use-after-free flaw enabling arbitrary code-execution in Flash . “ Adobe has released Vulnerability-related.PatchVulnerability security updates for Adobe Flash Player for Windows , macOS , Linux and Chrome OS , ” Adobe said in its release Vulnerability-related.PatchVulnerability . “ These updates address Vulnerability-related.PatchVulnerability one critical vulnerability in Adobe Flash Player and one important vulnerability in Adobe Flash Player installer . Successful exploitation could lead to arbitrary code-execution and privilege-escalation in the context of the current user respectively. ” The flaw was discovered Vulnerability-related.DiscoverVulnerability by Chenming Xu and Ed Miles of Gigamon ATR . Researchers also outlined Vulnerability-related.DiscoverVulnerability the further technical details about the exploit of the vulnerability . Impacted Vulnerability-related.DiscoverVulnerability is Adobe Flash Player Desktop Runtime , Adobe Flash Player for Google Chrome ; Adobe Flash Player for Microsoft Edge and Internet Explorer 11 ; all for versions 31.0.0.153 and earlier . Adobe Flash Player Installer versions 31.0.0.108 and earlier is also affected Vulnerability-related.DiscoverVulnerability . Users of these impacted products can update Vulnerability-related.PatchVulnerability to version 32.0.0.101 , according to Adobe . Users of Adobe Flash Player Installer can update Vulnerability-related.PatchVulnerability to version 31.0.0.122 . Adobe also patched Vulnerability-related.PatchVulnerability an important-rated insecure library loading ( via DLL hijacking ) vulnerability , CVE-2018-15983 , that could lead to privilege escalation via Adobe Flash . This is only the latest exploit to hit Adobe Flash – earlier in June , a zero-day Flash vulnerability was is being exploited Vulnerability-related.DiscoverVulnerability in the wild in targeted attacks against Windows users in the Middle East , according to researchers . Adobe dealt with another zero-day Flash vulnerability back in February , which was exploited Vulnerability-related.DiscoverVulnerability by North Korean hackers .

Another critical security hole has been found Vulnerability-related.DiscoverVulnerability in Apache Struts 2 , requiring an immediate update . The vulnerability – CVE-2018-11776 – affects Vulnerability-related.DiscoverVulnerability core code and allows miscreants to pull off remote code execution against vulnerable servers and websites . It affects Vulnerability-related.DiscoverVulnerability all versions of Struts 2 , the popular open-source framework for Java web apps . The Apache Software Foundation has `` urgently advised '' anyone using Struts to update Vulnerability-related.PatchVulnerability to the latest version immediately , noting that the last time a critical hole was found Vulnerability-related.DiscoverVulnerability , the holes were being exploited Vulnerability-related.DiscoverVulnerability in the wild just a day later . In other words , if you delay in patching Vulnerability-related.PatchVulnerability , your organization will be compromised in short order via this bug , if you are running vulnerable systems . It was that earlier flaw that led to a nightmare data breach Attack.Databreach from credit company Equifax after it failed to patch Vulnerability-related.PatchVulnerability swiftly enough . The details of nearly 150 million people were exposed Attack.Databreach , costing the company more than $ 600m , so this is not something to be taken lightly . The company that discovered Vulnerability-related.DiscoverVulnerability the vulnerability – Semmle Security Research Team – warns that this latest one is actually worse that the one last year , which it also found Vulnerability-related.DiscoverVulnerability . It has published a blog post with more information . Semmle found Vulnerability-related.DiscoverVulnerability the hole back in April and reported Vulnerability-related.DiscoverVulnerability it to Apache , which put out Vulnerability-related.PatchVulnerability a patch in June that it has now pulled Vulnerability-related.PatchVulnerability into formal updates ( 2.3.35 for those using version 2.3 and 2.5.17 for those on 2.5 ) . As mentioned , the vulnerability is in the core code and does n't require additional plugins to work . It is caused by insufficient validation of untrusted user data in the core of the Struts framework , and can be exploited in several different ways . Semmle says it has identified two different vectors but warns there may be others . Since it can be used remotely and due to the fact that Struts is typically used to create applications that are on the public internet , hackers are going to be especially focused on exploiting it so they can gain access to corporate networks . And there are some big targets out there : Apache Struts is extremely common with most large corporations using it somewhere in their systems for web apps . Semmle 's VP of engineering , Pavel Avgustinov , had this to say about the hole on Wednesday this week : `` Critical remote code execution vulnerabilities like the one that affected Vulnerability-related.DiscoverVulnerability Equifax and the one we announced today are incredibly dangerous for several reasons : Struts is used for publicly-accessible customer-facing websites , vulnerable systems are easily identified , and the flaw is easy to exploit Vulnerability-related.DiscoverVulnerability . A hacker can find their way in within minutes , and exfiltrate Attack.Databreach data or stage further attacks from the compromised system . It ’ s crucially important to update affected systems immediately ; to wait is to take an irresponsible risk . '' This is very far from the first time that big security holes have been found Vulnerability-related.DiscoverVulnerability in Struts , leading some to recommend that people simply stop using it .

As part of Microsoft 's monthly Patch Tuesday updates , a critical flaw in Windows has been patched Vulnerability-related.PatchVulnerability that is actively being exploited Vulnerability-related.DiscoverVulnerability . A vulnerability in the VBScript engine allowed for a zero-day exploit to infect machines by opening specially crafted scripts that can corrupt memory leading to the opportunity for arbitrary code execution . In a web-based attack , specially designed web pages could exploit the same vulnerability when using Internet Explorer . Embedding AcitveX controls that were marked `` safe for initialization '' inside of a Microsoft Office document also allowed for unsafe code to be executed since the IE rendering engine is used . One of the more interesting parts of the attack is that it does not matter what a user 's default browser is . When using VBScript , it is possible to force a web page to be loaded using Internet Explorer even if Chrome , FireFox , Safari , Opera or another browser is set to default . This particular vulnerability has been found Vulnerability-related.DiscoverVulnerability in use and affects Vulnerability-related.DiscoverVulnerability Windows 7 and Windows Server 2008 and newer . Kasperksy Lab has provided a fairly detailed analysis of how the exploit functions . In short , a statement from their security researchers says it all . `` We expect this vulnerability to become one of the most exploited in the near future , as it won ’ t be long until exploit kit authors start abusing it in both drive-by ( via browser ) and spear-phishing Attack.Phishing ( via document ) campaigns . '' In addition to the VBScript flaw discovered Vulnerability-related.DiscoverVulnerability and patched Vulnerability-related.PatchVulnerability , Microsoft has also patched Vulnerability-related.PatchVulnerability a privilege escalation vulnerability . A failure of the Win32k component allows for arbitrary code to be executed in kernel mode . This allows for a standard user account to obtain full system access , although it should be noted that a user must be logged in already to perform the exploit . In this case , both exploits have been patched Vulnerability-related.PatchVulnerability but that does not mean end users and administrators are going to patch Vulnerability-related.PatchVulnerability their systems in a timely manner . It is advised to manually check for updates to verify that all of the latest patches are installed . In total , 67 updates were issued Vulnerability-related.PatchVulnerability solving 21 critically rated vulnerabilities .

Microsoft this week released Vulnerability-related.PatchVulnerability software updates to fix Vulnerability-related.PatchVulnerability roughly 50 security problems with various versions of its Windows operating system and related software , including one flaw that is already being exploited Vulnerability-related.DiscoverVulnerability and another for which exploit code is publicly available . The zero-day bug — CVE-2018-8453 — affects Vulnerability-related.DiscoverVulnerability Windows versions 7 , 8.1 , 10 and Server 2008 , 2012 , 2016 and 2019 . According to security firm Ivanti , an attacker first needs to log into the operating system , but then can exploit this vulnerability to gain administrator privileges . Another vulnerability patched Vulnerability-related.PatchVulnerability on Tuesday — CVE-2018-8423 — was publicly disclosed Vulnerability-related.DiscoverVulnerability last month along with sample exploit code . This flaw involves a component shipped on all Windows machines and used by a number of programs , and could be exploited Vulnerability-related.DiscoverVulnerability by getting a user to open a specially-crafted file — such as a booby-trapped Microsoft Office document . KrebsOnSecurity has frequently suggested that Windows users wait a day or two after Microsoft releases Vulnerability-related.PatchVulnerability monthly security updates before installing the fixes , with the rationale that occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out . This month , Microsoft briefly paused Vulnerability-related.PatchVulnerability updates for Windows 10 users after many users reported losing all of the files in their “ My Documents ” folder . The worst part ? Rolling back to previous saved versions of Windows prior to the update did not restore the files . Microsoft appears to have since fixed Vulnerability-related.PatchVulnerability the issue , but these kinds of incidents Vulnerability-related.PatchVulnerability illustrate the value of not only waiting a day or two to install updates but also manually backing up your data prior to installing patches ( i.e. , not just simply counting on Microsoft ’ s System Restore feature to save the day should things go haywire ) . Mercifully , Adobe has spared Vulnerability-related.PatchVulnerability us an update this month for its Flash Player software , although it has shipped Vulnerability-related.PatchVulnerability a non-security update for Flash .

Adobe has patched Vulnerability-related.PatchVulnerability 87 vulnerabilities for Acrobat and Reader in its December Patch Tuesday update , including a slew of critical flaws that would allow arbitrary code-execution . The scheduled update comes less than a week after Adobe released Vulnerability-related.PatchVulnerability several out-of-band fixes for Flash Player , including a critical vulnerability ( CVE-2018-15982 ) that it said is being exploited Vulnerability-related.DiscoverVulnerability in the wild . That ’ s a use-after-free flaw enabling arbitrary code-execution in Flash . The addressed critical vulnerabilities are myriad this month . The arbitrary code-execution problems include : two buffer errors ; two untrusted pointer dereference glitches ; three heap-overflow issues , five out-of-bounds write flaws , 24 use-after-free bugs . Adobe also patched Vulnerability-related.PatchVulnerability three other critical-rated issues that could lead to privilege escalation ; these are all security bypass problems . In addition to the critical bugs , Adobe also patched Vulnerability-related.PatchVulnerability 43 out-of-bounds read flaws , four integer overflow problems and two security bypass issues , all of which could allow information disclosure . Adobe has characterized all of the flaws , both critical and important , as “ priority two ” for patching Vulnerability-related.PatchVulnerability , which means that the software giant deems them to be unlikely to be imminently exploited Vulnerability-related.DiscoverVulnerability in the wild , but patching Vulnerability-related.PatchVulnerability within 30 days is recommended . The flaws are far-reaching and affect Vulnerability-related.DiscoverVulnerability various implementations of Acrobat DC , Acrobat Reader DC , Acrobat 2017 and Acrobat Reader 2017 for macOS and Windows , in classic 2015 , classic 2017 and continuous-track versions . All can be mitigated by updating Vulnerability-related.PatchVulnerability to the most current versions of the software .

A severe WordPress vulnerability which has been left a year without being patched Vulnerability-related.PatchVulnerability has the potential to disrupt countless websites running the CMS , researchers claim Vulnerability-related.DiscoverVulnerability . At the BSides technical cybersecurity conference in Manchester on Thursday , Secarma researcher Sam Thomas said Vulnerability-related.DiscoverVulnerability the bug permits attackers to exploit the WordPress PHP framework , resulting in a full system compromise . If the domain permits the upload of files , such as image formats , attackers can upload a crafted thumbnail file in order to trigger a file operation through the `` phar : // '' stream wrapper . In turn , the exploit triggers eXternal Entity ( XXE -- XML ) and Server Side Request Forgery ( SSRF ) flaws which cause unserialization in the platform 's code . While these flaws may only originally result in information disclosure and may be low risk , they can act as a pathway to a more serious remote code execution attack . The security researcher says Vulnerability-related.DiscoverVulnerability the core vulnerability , which is yet to receive a CVE Vulnerability-related.DiscoverVulnerability number , is within the wp_get_attachment_thumb_file function in /wpincludes/post.php and when attackers gain control of a parameter used in the `` file_exists '' call , '' the bug can be triggered . Unserialization occurs when serialized variables are converted back into PHP values . When autoloading is in place , this can result in code being loaded and executed , an avenue attackers may exploit in order to compromise PHP-based frameworks . `` Unserialization of attacker-controlled data is a known critical vulnerability , potentially resulting in the execution of malicious code , '' the company says . The issue of unserialization was first uncovered Vulnerability-related.DiscoverVulnerability back in 2009 , and since then , vulnerabilities have been recognized Vulnerability-related.DiscoverVulnerability in which the integrity of PHP systems can be compromised , such as CVE-2017-12934 , CVE-2017-12933 , and CVE-2017- 12932 . The WordPress content management system ( CMS ) is used by millions of webmasters to manage domains , which means the vulnerability potentially has a vast victim pool should the flaw being exploited Vulnerability-related.DiscoverVulnerability in the wild . `` I 've highlighted that the unserialization is exposed to a lot of vulnerabilities that might have previously been considered quite low-risk , '' Thomas explainde . `` Issues which they might have thought were fixed Vulnerability-related.PatchVulnerability with a configuration change or had been considered quite minor previously might need to be reevaluated in the light of the attacks I demonstrated . '' According to Secarma , the CMS provider was made aware Vulnerability-related.DiscoverVulnerability of the security issue in February 2017 , but `` is yet to take action . '' TechRepublic : The need for speed : Why you should optimize your CMS Technical details have been provided in a white paper ( .PDF ) . `` This research continues a worrying recent trend , in demonstrating that object ( un ) serialization is an integral part of several modern languages , '' Thomas said . `` We must constantly be aware of the security impact of such mechanisms being exposed to attackers . '' No reports have been received which suggest the exploit is being actively used in the wild . The vulnerability was originally reported Vulnerability-related.DiscoverVulnerability through the WordPress HackerOne bug bounty program last year . The issue was confirmed Vulnerability-related.DiscoverVulnerability after several days and Thomas was credited for his findings . However , a Secarma spokesperson told ZDNet that while there was `` some attempt to fix Vulnerability-related.PatchVulnerability the issue '' in May 2017 , this did not address Vulnerability-related.PatchVulnerability the problem . `` Communication then went dead for a number of months and has only recently begun again , '' the spokesperson added . ZDNet has reached out to WordPress and will update if we hear back .

Cisco has resolved Vulnerability-related.PatchVulnerability a set of critical vulnerabilities in Policy Suite which permit attackers to cause havoc in the software 's databases . This week , the tech giant released Vulnerability-related.PatchVulnerability a security advisory detailing four vulnerabilities which could place enterprise users at risk of information leaks , account compromise , database tampering , and more . The first vulnerability , CVE-2018-0374 , has earned a CVSS base score of 9.8 . Described as Vulnerability-related.DiscoverVulnerability an unauthenticated bypass bug , the security flaw `` could allow an unauthenticated , remote attacker to connect directly to the Policy Builder database , '' according to Cisco . The bug has been caused by a simple lack of authentication and as there is no requirement for identity verification , Policy Builder databases can be accessed and tampering with without limitation . Cisco Policy Suite releases prior to 18.2.0 are affected Vulnerability-related.DiscoverVulnerability . The second vulnerability , CVE-2018-0375 , is a default password error . The CVSS 9.8 bug is present in Vulnerability-related.DiscoverVulnerability the Cluster Manager of Cisco Policy Suite and could allow an unauthenticated , remote attacker to log in to a vulnerable system using a root account . The serious security problem has emerged Vulnerability-related.DiscoverVulnerability due to the use of undocumented , static user credentials for root accounts . If a hacker has knowledge of these credentials , they can become a root user and are able to execute arbitrary commands . Versions of the software prior to 18.2.0 are vulnerable Vulnerability-related.DiscoverVulnerability to exploit . The third bug , CVE-2018-0376 , is another unauthenticated access problem and is also caused by a lack of authentication measures . `` A successful exploit could allow the attacker to make changes to existing repositories and create new repositories , '' Cisco says Vulnerability-related.DiscoverVulnerability . Cisco Policy Suite versions prior to 18.2.0 are affected Vulnerability-related.DiscoverVulnerability . The fourth security flaw , CVE-2018-0377 , affects Vulnerability-related.DiscoverVulnerability the Open Systems Gateway initiative ( OSGi ) interface of Cisco Policy Suite . There is a lack of authentication within the OSGi interface which permits attackers to circumvent security processes and directly connect to the interface , access any files contained within they wish , and modify any content which is accessible through the process . This vulnerability impacts Vulnerability-related.DiscoverVulnerability Policy Suite versions prior to 18.1.0 . There are no workarounds to circumvent these vulnerabilities . However , patches have been issued to address Vulnerability-related.PatchVulnerability them and Cisco says that no reports have been received which indicate the bugs are being exploited Vulnerability-related.DiscoverVulnerability in the wild . In addition , Cisco has revealed Vulnerability-related.DiscoverVulnerability seven now-patched bugs affecting Vulnerability-related.DiscoverVulnerability SD-WAN solutions . The vulnerabilities included command injection security flaws , a remote code execution bug , and arbitrary file overwrite issues .

Yesterday , on Microsoft ’ s Patch Tuesday the company released Vulnerability-related.PatchVulnerability its monthly security patches that fixed Vulnerability-related.PatchVulnerability 62 security flaws . These fixes also included a fix for a zero-day vulnerability that was under active exploitation before these patches were made available Vulnerability-related.PatchVulnerability . Microsoft also announced the re-release of its Windows 10 version 1809 and Windows Server 2019 . Microsoft credited Kaspersky Lab researchers for discovering Vulnerability-related.DiscoverVulnerability this zero-day , which is also known as Vulnerability-related.DiscoverVulnerability CVE-2018-8589 and impacts Vulnerability-related.DiscoverVulnerability the Windows Win32k component . A Kaspersky spokesperson told ZDNet , “ they discovered Vulnerability-related.DiscoverVulnerability the zero-day being exploited Vulnerability-related.DiscoverVulnerability by multiple cyber-espionage groups ( APTs ) . ” The zero-day had been used to elevate privileges on 32-bit Windows 7 versions . This is the second Windows elevation of privilege zero-day patched Vulnerability-related.PatchVulnerability by Microsoft discovered Vulnerability-related.DiscoverVulnerability by Kaspersky researchers . Last month , Microsoft patched Vulnerability-related.PatchVulnerability CVE-2018-8453 , another zero-day that had been used by a state-backed cyber-espionage group known as FruityArmor . However , in this month ’ s Patch Tuesday , Microsoft has not patched Vulnerability-related.PatchVulnerability a zero-day that is affecting Vulnerability-related.DiscoverVulnerability the Windows Data Sharing Service ( dssvc.dll ) . This zero-day was disclosed Vulnerability-related.DiscoverVulnerability on Twitter at the end of October . According to ZDNet , “ Microsoft has published this month a security advisory to instruct users on how to properly configure BitLocker when used together with solid-state drives ( SSDs ) . ” As reported by Microsoft , the Windows 10 October 2018 update caused user ’ s data loss post updating . Due to this , the company decided to pause the update . However , yesterday , Microsoft announced that it is re-releasing Windows 10 version 1809 . John Cable , the director of Program Management for Windows Servicing and Delivery at Microsoft said , “ the data-destroying bug that triggered that unprecedented decision , as well as other quality issues that emerged during the unscheduled hiatus , have been thoroughly investigated and resolved. ” Microsoft also announced the re-release of Windows Server 2019 , which was affected Vulnerability-related.DiscoverVulnerability by the same issue . According to ZDNet , “ The first step in the re-release is to restore the installation files to its Windows 10 Download page so that “ seekers ” ( the Microsoft term for advanced users who go out of their way to install a new Windows version ) can use the ISO files to upgrade PCs running older Windows 10 versions. ” Michael Fortin , Windows Corporate Vice President , in a blog post , offered some context behind the recent issues and announced changes to the way the company approaches communications and also the transparency around their process . Per Fortin , “ We obsess over these metrics as we strive to improve product quality , comparing current quality levels across a variety of metrics to historical trends and digging into any anomaly. ” To know more about this in detail , visit Microsoft ’ s official blog post .

Researchers from security firm ERPScan have disclosed Vulnerability-related.DiscoverVulnerability a vulnerability in the SAP GUI application which it has described as Vulnerability-related.DiscoverVulnerability perhaps the most dangerous SAP issue since 2011 , as it affects not only every SAP customer but also every user . The vulnerability allows an attacker to make all endpoints with compromised SAP GUI clients automatically install malware that locks their computers when an SAP user logs in to the system . When the user next logs into the SAP GUI application , the malicious software will run and prevent them from logging on to SAP Server . Firstly , in this case , patching process is especially laborious and time-consuming , as the vulnerability affects Vulnerability-related.DiscoverVulnerability client side , so an SAP administrator has to apply Vulnerability-related.PatchVulnerability the patch on every endpoint with SAP GUI in a company and a typical enterprise has thousands of them , ” said Vulnerability-related.DiscoverVulnerability Vahagn Vardanyan , senior security researcher , ERPScan . The vulnerability was patched Vulnerability-related.PatchVulnerability by SAP with a fix as part of its March Security Note 2407616 . An SAP spokesperson confirmed that a SAP GUI vulnerability was fixed Vulnerability-related.PatchVulnerability in the March Patch Day , with further details available via this blog post . “ It has a priority of High , based on CVSS rating of 8.0 ( but not Very High ) . We have no information or evidence of this vulnerability being exploited Vulnerability-related.DiscoverVulnerability at a customer but advise all customers to patch Vulnerability-related.PatchVulnerability their infrastructure immediately . Customers are required to apply Vulnerability-related.PatchVulnerability the SAP GUI patch released Vulnerability-related.PatchVulnerability on their landscape using their standard client software distribution and update tools ( which they would have in place for end-user software licensed from other vendors as well ) , ” the spokesperson said . Pingback : SAP GUI vulnerability “ most dangerous ” since 201

A popular version of the open source Magento ecommerce platform is vulnerable Vulnerability-related.DiscoverVulnerability to a zero-day remote code execution vulnerability , putting as many as 200,000 online retailers at risk . The warning comes from security firm DefenseCode , which found Vulnerability-related.DiscoverVulnerability and originally reported Vulnerability-related.DiscoverVulnerability the vulnerability to Magento in November . “ During the security audit of Magento Community Edition , a high risk vulnerability was discovered Vulnerability-related.DiscoverVulnerability that could lead to remote code execution and thus the complete system compromise including the database containing sensitive customer information such as stored credit card numbers and other payment information , ” DefenseCode wrote in a technical description of its discovery ( PDF ) posted Wednesday . According Bosko Stankovic , information security engineer at DefenseCode , despite repeated efforts to notify Vulnerability-related.DiscoverVulnerability Magento , which began in November 2016 , the vulnerability remains unpatched Vulnerability-related.PatchVulnerability despite four version updates since the disclosure Vulnerability-related.DiscoverVulnerability . DefenseCode did not examine Magento Enterprise , the commercial version of the platform , but warns both share the same underlying vulnerable code . “ We ’ re unsure if this vulnerability is actively being exploited Vulnerability-related.DiscoverVulnerability in the wild , but since the vulnerability has been unpatched Vulnerability-related.PatchVulnerability for so long it provides a window of opportunity for potential hackers , ” Stankovic said . Magento confirmed the existence Vulnerability-related.DiscoverVulnerability of the flaw in a brief statement to Threatpost and said it was investigating . “ We have been actively investigating Vulnerability-related.DiscoverVulnerability the root cause of the reported issue and are not aware of any attacks in the wild . We will be addressing Vulnerability-related.PatchVulnerability the issue in our next patch release and continue to consistently work to improve our assurance processes , ” Magento said in a statement . Yesterday , Threatpost reported Vulnerability-related.DiscoverVulnerability a story about a remote code execution vulnerability with Magento 2 Enterprise and Community software . Magento is committed to delivering superior security to clients and has been actively investigating Vulnerability-related.DiscoverVulnerability the root cause of the reported issue . We are not aware of any attacks in the wild . Admin access is required to execute the exploit , so as always , we encourage you to follow best practices to keep your Admin secure . In addition , this vulnerability will be addressed Vulnerability-related.PatchVulnerability in our next release Vulnerability-related.PatchVulnerability targeted for early May . Until then , we recommend enforcing the use of “ Add Secret Key to URLs ” to mitigate potential attacks .

Businesses that failed to update Windows-based computer systems that were hit by a massive cyber attack over the weekend could be sued over their lax cyber security , but Microsoft itself enjoys strong protection from lawsuits , legal experts said . The WannaCry worm has affected more than 200,000 Windows computers around the world since Friday , disrupting Attack.Ransom car factories , global shipper FedEx Corp and Britain 's National Health Service , among others . The hacking tool spreads silently between computers , shutting them down by encrypting data and then demanding a ransom Attack.Ransom of US $ 300 to unlock them . According to Microsoft , computers affected by the ransomware did not have security patches for various Windows versions installed or were running Windows XP , which the company no longer supports . `` Using outdated versions of Windows that are no longer supported raises a lot of questions , '' said Christopher Dore , a lawyer specializing in digital privacy law at Edelson PC . `` It would arguably be knowingly negligent to let those systems stay in place. ” Businesses could face legal claims if they failed to deliver services because of the attack , said Edward McAndrew , a data privacy lawyer at Ballard Spahr . `` There is this stream of liability that flows from the ransomware attack Attack.Ransom , '' he said `` That 's liability to individuals , consumers and patients , '' WannaCry exploits Vulnerability-related.DiscoverVulnerability a vulnerability in older versions of Windows , including Windows 7 and Windows XP . Microsoft issued Vulnerability-related.PatchVulnerability a security update in March that stops WannaCry and other malware in Windows 7 . Over the weekend the company took the unusual step of releasing Vulnerability-related.PatchVulnerability a similar patch for Windows XP , which the company announced in 2014 it would no longer support . Dore said companies that faced disruptions because they did not run the Microsoft update or because they were using older versions of Windows could face lawsuits if they publicly touted their cyber security . His law firm sued LinkedIn after a 2012 data breach Attack.Databreach , alleging individuals paid for premium accounts because the company falsely stated it had top-quality cyber security measures . LinkedIn settled for US $ 1.25 million in 2014 . But Scott Vernick , a data security lawyer at Fox Rothschild that represents companies , said he was sceptical that WannaCry would produce a flood of consumer lawsuits . He noted there was no indication the cyber attack had resulted in widespread disclosure of personal data . `` It isn ’ t clear that there has been a harm to consumers , '' he said . Vernick said businesses that failed to update their software could face scrutiny from the US Federal Trade Commission , which has previously sued companies for misrepresenting their data privacy measures . Microsoft itself is unlikely to face legal trouble over the flaw in Windows being exploited Vulnerability-related.DiscoverVulnerability by WannaCry , according to legal experts . When Microsoft sells software it does so through a licensing agreement that states the company is not liable for any security breaches , said Michael Scott , a professor at Southwestern Law School . Courts have consistently upheld those agreements , he said . Alex Abdo , a staff attorney at the Knight First Amendment Institute at Columbia University , said Microsoft and other software companies have strategically settled lawsuits that could lead to court rulings weakening their licensing agreements . `` This area of law has been stunted in its growth , '' he said . `` It is very difficult to hold software manufacturers accountable for flaws in their products . '' Also enjoying strong protection from liability over the cyber attack is the US National Security Agency , whose stolen hacking tool is believed to be the basis for WannaCry . The NSA did not immediately return a request for comment . Jonathan Zittrain , a professor specializing in internet law at Harvard Law School , said courts have frequently dismissed lawsuits against the agency on the grounds they might result in the disclosure of top secret information . On top of that , the NSA would likely be able to claim that it is shielded from liability under the doctrine of sovereign immunity , which says that the government can not be sued over carrying out its official duties . `` I doubt there can be any liability that stems back to the NSA , '' Dore said .

A decade ago , cross-site request forgery ( CSRF , often pronounced “ c-surf ” ) was considered to be a sleeping giant , preparing to wake and inflict havoc on the Worldwide Web . But the doomsday scenario never materialized and you don ’ t even seem to hear much about it anymore . In this blog post , part 1 of 2 , I will explore this idea and try to understand why the CSRF giant never awoke . First we ’ ll cover the overall threat landscape , trends , and some notable CSRF exploits throughout the years , including one from personal experience . As a quick review , CSRF exists because web applications trust the cookies sent by web browsers within an HTTP request . In a CSRF attack , the attacker causes a victim ’ s browser to make a request that results in a change or action which benefits the attacker ( and/or harms the victim ) in some way . Without a specific defense – like a random token in the request body that is validated on the server side – CSRF attacks are possible . After a bit of testing , my suspicions were confirmed . All requests that caused any sort of change could be exploited with CSRF . This included : I contacted the company to let them know Vulnerability-related.DiscoverVulnerability about these security holes . Surprisingly , they didn ’ t seem to be aware there was such a thing as CSRF , but they thanked me anyway and rolled out Vulnerability-related.PatchVulnerability a fix about a month later . There have been other notable instances of CSRF vulnerabilities with some of them being exploited Vulnerability-related.DiscoverVulnerability in the wild . Drive-by pharming is an attack on the DNS settings of home routers and modems and often leverages CSRF as a key element . The web UIs on these devices are the culprit , because they allow users to edit configuration settings . In one attack from 2008 , banking customers in Mexico who owned 2Wire DSL modems were targeted . Victims received an email with an embedded image tag with a CSRF attack that changed the DNS settings on their modem . In another instance , tens of thousands of Twitter users fell victim to a CSRF worm in 2010 when developers failed to implement anti-CSRF measures for tweets . The vulnerability was discovered Vulnerability-related.DiscoverVulnerability and exploited Vulnerability-related.DiscoverVulnerability in a rather distasteful but harmless way . When authenticated Twitter users visited the web page containing the exploit , they unknowingly posted two tweets – one with a link to the same page and another with a message about goats . Anyone who clicked on the link in the first tweet also posted the same two tweets . The worm spread like wildfire before it was fixed by Twitter . In 2012 Facebook ’ s App Center was vulnerable Vulnerability-related.DiscoverVulnerability to CSRF and the security researcher who discovered Vulnerability-related.DiscoverVulnerability the flaw was awarded $ 5000 as a bounty . Interestingly , in this case the HTTP request included an anti-CSRF token that appeared at first glance to provide protection , but the token was not being validated by the server-side application when the request was received . A Qualys researcher found other examples where anti-CSRF tokens were not properly validated . And similar to the Facebook issue mentioned above , PayPal in 2016 did not validate the anti-CSRF token in paypal.me . An attacker could only change a user ’ s profile photo in that case however .

Adobe has patched Vulnerability-related.PatchVulnerability two critical flaws in Acrobat and Reader that warrant urgent attention . Officially , Adobe patches Vulnerability-related.PatchVulnerability security vulnerabilities around the middle of each month to coordinate with Microsoft ’ s Patch Tuesday , but recently it ’ s become almost routine for the company to issue Vulnerability-related.PatchVulnerability out-of-band updates in between . APSB19-02 , the first of such updates to reach customers in the new year , addresses Vulnerability-related.PatchVulnerability critical flaws with a priority rating of ‘ 2 ’ . That means that the flaw is potentially serious , but Adobe hasn ’ t detected Vulnerability-related.DiscoverVulnerability any real-world exploits ( the latter would entail issuing Vulnerability-related.PatchVulnerability an ‘ emergency ’ patch with a ‘ 1 ’ rating ) . The first flaw , identified Vulnerability-related.DiscoverVulnerability as CVE-2018-16011 , is described Vulnerability-related.DiscoverVulnerability by Adobe as a use-after-free bug that could be exploited Vulnerability-related.DiscoverVulnerability using a maliciously crafted PDF to take control of a target system with their malware of choice . The second , CVE-2018-16018 ( replacing CVE-2018-19725 ) , is a security bypass targeting JavaScript API restrictions on Adobe Reader DC and seems to have been in the works since before Christmas , affecting Vulnerability-related.DiscoverVulnerability all versions of Window and macOS Acrobat DC/Reader 2019.010.20064 and earlier , the fix in both cases is to update Vulnerability-related.PatchVulnerability to 2019.010.20069 . For the legacy Acrobat/Reader 2017 2017.011.30110 and Acrobat/Reader DC 2015 2015.006.30461 , the updates take those to 2017.011.30113 and 2015.006.30464 respectively . As critical flaws with a ‘ 2 ’ rating , there is a suggested 30-day window within which to apply Vulnerability-related.PatchVulnerability the updates , but it ’ s worth bearing in mind that a new round of patches will likely be offered Vulnerability-related.PatchVulnerability for Adobe products tomorrow as part of Patch Tuesday . In December ’ s Patch Tuesday , Adobe released Vulnerability-related.PatchVulnerability a not inconsiderable 87 patches , including 39 rated critical . Only days before , Adobe issued Vulnerability-related.PatchVulnerability an emergency Flash patch for a zero-day vulnerability that was being exploited Vulnerability-related.DiscoverVulnerability , while in November Flash received Vulnerability-related.PatchVulnerability a separate patch for one whose exploitation was believed to be imminent .

In a string of attacks that have escalated over the past 48 hours , hackers are actively exploiting a critical vulnerability that allows them to take almost complete control of Web servers used by banks , government agencies , and large Internet companies . The code-execution bug resides in Vulnerability-related.DiscoverVulnerability the Apache Struts 2 Web application framework and is trivial to exploit . Although maintainers of the open source project patched Vulnerability-related.PatchVulnerability the vulnerability on Monday , it remains under attack by hackers who are exploiting it to inject commands of their choice into Struts servers that have yet to install the update , researchers are warning Vulnerability-related.DiscoverVulnerability . Making matters worse , at least two working exploits are publicly available . `` We have dedicated hours to reporting to companies , governments , manufacturers , and even individuals to patch Vulnerability-related.PatchVulnerability and correct the vulnerability as soon as possible , but the exploit has already jumped to the big pages of 'advisories , ' and massive attempts to exploit the Internet have already been observed . '' Researchers at Cisco Systems said they are seeing a `` high number of exploitation events '' by hackers attempting to carry out a variety of malicious acts . One series of commands that attackers are injecting into webpages stops the firewall protecting the server and then downloads and executes malware of the attacker 's choice . The payloads include `` IRC bouncers , '' which allow the attackers to hide their real IP address during Internet chats ; denial-of-service bots ; and various other packages that conscript a server into a botnet . `` These are several of the many examples of attacks we are currently observing and blocking , '' Cisco 's Nick Biasini wrote . `` They fall into two broad categories : probing and malware distribution . The payloads being delivered vary considerably , and to their credit , many of the sites have already been taken down and the payloads are no longer available . '' The vulnerability resides in Vulnerability-related.DiscoverVulnerability what 's known as the Jakarta file upload multipart parser , which according to official Apache Struts 2 documentation is a standard part of the framework and needs only a supporting library to function . Apache Struts versions affected by Vulnerability-related.DiscoverVulnerability the vulnerability include Struts 2.3.5 through 2.3.31 , and 2.5 through 2.5.10 . Servers running any of these versions should upgrade to Vulnerability-related.PatchVulnerability 2.3.32 or 2.5.10.1 immediately . It 's not clear why the vulnerability is being exploited Vulnerability-related.DiscoverVulnerability so widely 48 hours after a patch was released Vulnerability-related.PatchVulnerability . One possibility is that the Apache Struts maintainers did n't adequately communicate the risk . Although they categorize Vulnerability-related.DiscoverVulnerability the vulnerability security rating as high , they also describe Vulnerability-related.DiscoverVulnerability it as posing a `` possible remote code execution '' risk . Outside researchers , meanwhile , have said the exploits are trivial to carry out , are highly reliable , and require no authentication . It 's also easy to scan the Internet for vulnerable servers . It 's also possible to exploit the bug even if a Web application does n't implement file upload functionality . Update 3/9/2017 10:07 California time : In a comment to this post , Ars Technology Editor Peter Bright provides Vulnerability-related.PatchVulnerability a much more plausible explanation for the delay in patching Vulnerability-related.PatchVulnerability this highly critical vulnerability . Most bug fixes Vulnerability-related.PatchVulnerability , he pointed out , require downloading and installing a patch , possibly rebooting a machine , and being done with it .

Data: CASIE

Trigger word: being exploited

Event Types (Count): Vulnerability-related.DiscoverVulnerability (16)

Negative Trigger