Vendors are reacting Vulnerability-related.DiscoverVulnerability swiftly to a vulnerability that lets attackers eavesdrop on your network traffic . Monday morning was not a great time to be an IT admin , with the public release Vulnerability-related.DiscoverVulnerability of a bug that effectively broke WPA2 wireless security . As reported Vulnerability-related.DiscoverVulnerability previously by ZDNet , the bug , dubbed `` KRACK '' -- which stands for Key Reinstallation Attack -- is at heart a fundamental flaw in the way Wi-Fi Protected Access II ( WPA2 ) operates . The security protocol , an upgrade from WEP , is used to protect and secure communications between everything from our routers , mobile devices , and Internet of Things ( IoT ) devices , but there is an issue in the system 's four-way handshake that permits devices with a pre-shared password to join a network . According to security researcher and academic Mathy Vanhoef , who discovered Vulnerability-related.DiscoverVulnerability the flaw , threat actors can leverage the vulnerability to decrypt traffic , hijack connections , perform man-in-the-middle attacks , and eavesdrop on communication sent from a WPA2-enabled device . US-CERT has known Vulnerability-related.DiscoverVulnerability of the bug for some months and informed Vulnerability-related.DiscoverVulnerability vendors ahead of the public disclosure Vulnerability-related.DiscoverVulnerability to give them time to prepare Vulnerability-related.PatchVulnerability patches and prevent Vulnerability-related.PatchVulnerability the vulnerability from being exploited Vulnerability-related.DiscoverVulnerability in the wild -- of which there are no current reports Vulnerability-related.DiscoverVulnerability of this bug being harnessed by cyberattackers . The bug is present in Vulnerability-related.DiscoverVulnerability WPA2 's cryptographic nonce and can be utilized to dupe a connected party into reinstalling a key which is already in use . While the nonce is meant to prevent replay attacks , in this case , attackers are then given the opportunity to replay , decrypt , or forge packets . In general , Windows and newer versions of iOS are unaffected Vulnerability-related.DiscoverVulnerability , but the bug can have a serious impact on Vulnerability-related.DiscoverVulnerability Android 6.0 Marshmallow and newer . The attack could also be devastating for IoT devices , as vendors often fail to implement acceptable security standards or update systems in the supply chain , which has already led to millions of vulnerable and unpatched IoT devices being exposed for use by botnets . The vulnerability does not mean the world of WPA2 has come crumbling down , but it is up to vendors to mitigate Vulnerability-related.PatchVulnerability the issues this may cause . In total , ten CVE numbers have been preserved to describe Vulnerability-related.DiscoverVulnerability the vulnerability and its impact Vulnerability-related.DiscoverVulnerability , and according to the US Department of Homeland Security ( DHS ) , the main affected vendors are Aruba , Cisco , Espressif Systems , Fortinet , the FreeBSD Project , HostAP , Intel , Juniper Networks , Microchip Technology , Red Hat , Samsung , various units of Toshiba and Ubiquiti Networks .

The two vulnerabilities are critical remote code execution flaws that exist in Vulnerability-related.DiscoverVulnerability Adobe Photoshop CC . Adobe hurried out Vulnerability-related.PatchVulnerability unscheduled patches today for two critical flaws that could enable remote code-execution in Photoshop CC . The patches impact Vulnerability-related.PatchVulnerability two memory corruption vulnerabilities in Adobe Photoshop products , including Photoshop CC 2018 ( v 19.1.6 ) and Photoshop CC 2017 ( v 18.1.6 ) , both for Windows and macOS . The release comes Vulnerability-related.PatchVulnerability only a week after the company fixed Vulnerability-related.PatchVulnerability a slew of glitches last Patch Tuesday . “ Adobe has released Vulnerability-related.PatchVulnerability updates for Photoshop CC for Windows and macOS , ” the company said in a Wednesday security bulletin . “ These updates resolve Vulnerability-related.PatchVulnerability critical vulnerabilities in Photoshop CC 19.1.5 and earlier 19.x versions , as well as 18.1.5 and earlier 18.x versions . Successful exploitation could lead to arbitrary code-execution in the context of the current user. ” Both vulnerabilities ( CVE-2018-12810 ) and ( CVE-2018-12811 ) are critical remote code-execution flaws , according to the advisory , but further details around both flaws are not available . Kushal Arvind Shah of Fortinet ’ s FortiGuard Labs was credited with reporting Vulnerability-related.DiscoverVulnerability the two flaws . Adobe said impacted users need to apply Vulnerability-related.PatchVulnerability the fixes to the affected versions of Photoshop by updating to version 19.1.6 ( via the applications ’ update mechanism ) . Last week , Adobe released Vulnerability-related.PatchVulnerability 11 total fixes for an array of products , including two critical patches for Acrobat and Reader for Windows and macOS . Exploitation of those two vulnerabilities could lead to arbitrary code execution in the context of the current user . Adobe said in an email that it is not aware of any exploits in the wild for the flaws . The update is a priority 3 in severity , meaning that it resolves vulnerabilities in a product that has historically not been a target for attackers , according to the company ’ s ranking system . In this case I would expect there may have been a disclosure deadline and the release did not make this month ’ s typical release cycle but needed to release before September ’ s release cycle . ”

A zero-day vulnerability present in Vulnerability-related.DiscoverVulnerability security cameras and surveillance equipment using Nuuo software is thought to impact Vulnerability-related.DiscoverVulnerability hundreds of thousands of devices worldwide . Researchers from cybersecurity firm Tenable disclosed Vulnerability-related.DiscoverVulnerability the bug , which has been assigned as CVE-2018-1149 . The vulnerability can not get much more serious , as it allows attackers to remotely execute code in the software , the researchers said in a security advisory on Monday . Nuuo , describing itself as a provider of `` trusted video management '' software , offers a range of video solutions for surveillance systems in industries including transport , banking , government , and residential areas . Dubbed `` Peekaboo , '' the zero-day stack buffer overflow vulnerability , when exploited Vulnerability-related.DiscoverVulnerability , allows threat actors to view and tamper with video surveillance recordings and feeds . It is also possible to use the bug to steal Attack.Databreach data including credentials , IP addresses , port usage , and the make & models of connected surveillance devices . Such a security vulnerability has wide-reaching , real-world consequences -- as criminals could compromise a surveillance camera feed , replace the footage with a static image , and raid a premises , for example . In addition , the bug could be used to fully disable cameras and surveillance products . Peekaboo specifically impacts Vulnerability-related.DiscoverVulnerability the NVRMini 2 NAS and network video recorder , which acts as a hub for connected surveillance products . When exploited , the product permitted access to the control management system ( CMS ) interface , which further exposes credentials of all connected video surveillance cameras connected to the storage system . Speaking to ZDNet , Gavin Millard , VP of threat intelligence at Tenable , said that organizations all over the world use Nuuo software , including in shopping centers , hospitals , banks , and public areas . However , therein lies the problem -- as the software is also white labeled to over 100 brands and 2,500 camera product lines . Tenable disclosed Vulnerability-related.DiscoverVulnerability the zero-day vulnerability to Nuuo . A patch has not been released Vulnerability-related.PatchVulnerability , but Nuuo is currently developing Vulnerability-related.PatchVulnerability a fix for deployment . A plugin has also been released Vulnerability-related.PatchVulnerability by Tenable for organizations to assess whether or not they are vulnerable Vulnerability-related.DiscoverVulnerability to Peekaboo . ZDNet has reached out to Nuuo and will update if we hear back .

Oracle has released Vulnerability-related.PatchVulnerability a wide-ranging security update to address Vulnerability-related.PatchVulnerability more than 300 CVE-listed vulnerabilities in its various enterprise products . The October release covers the gamut of Oracle 's offerings , including its flagship Database , E-Business Suite , and Fusion Middleware packages . For Database , the update addresses Vulnerability-related.PatchVulnerability a total of three flaws . Two of the vulnerabilities ( CVE-2018-3259 and CVE-2018-3299 ) can be remotely exploited Vulnerability-related.DiscoverVulnerability without authentication , while the third , CVE-2018-7489 , would require the user to have a Rapid Home Provisioning account to execute and is considered by far the least severe of the three . Oracle noted Vulnerability-related.DiscoverVulnerability that all three bugs only impact Vulnerability-related.DiscoverVulnerability the server versions of Database , user clients are not considered to be vulnerable Vulnerability-related.DiscoverVulnerability . For Fusion Middleware , the update will include a total of 56 CVE-listed flaws , including 12 that are remotely exploitable with CVSS base scores of 9.8 , meaning an exploit would be fairly easy to pull off and offer near total control of the target machine . Of those 12 , five were for critical flaws in WebLogic Server . Java SE will get Vulnerability-related.PatchVulnerability 12 security fixes , with all but one being for remotely exploitable vulnerabilities in that platform . Oracle notes Vulnerability-related.DiscoverVulnerability that though the CVSS scores for the flaws are fairly high , Solaris and Linux machines running software with lower user privileges will be considered to be at a lower risk than Windows environments that typically operate with admin privileges . MySQL was the target of 38 CVE-listed bug fixes this month , through just three of those are remotely exploitable . The two most serious , CVE-2018-11776 and CVE-2018-8014 , concern remote code flaws in MySQL Enterprise Monitor . PeopleSoft will see 24 bug fixes , 21 of which can be remotely targeted and seven that would not require any user interaction . Just one of the 24 flaws was given a CVSS base score higher than 7.2. in the Oracle listing . Sun products were the subject of 19 security fixes , including two remote code execution flaws in XCP Firmware . libssh bug more like `` oh SSH… '' Once admins get Vulnerability-related.PatchVulnerability the Oracle patches in place , they will want to take a close look at the write-up for CVE-2018-10933 , an authentication bypass for libssh that would allow an attacker to get into a target machine by sending a `` SSH2_MSG_USERAUTH_SUCCESS '' message when it expects a `` SSH2_MSG_USERAUTH_REQUEST '' message . That means any miscreant can log in without a password or other credential . As you can imagine , this is a very bad thing . Fortunately , the bug does not affect OpenSSH – and thus does not affect the hugely widespread sshd and ssh tools – but rather applications , such as KDE and XMBC , that use libssh as a dependency .

Adobe has resolved Vulnerability-related.PatchVulnerability 11 security flaws in this month 's patch update on the heels of a far larger security round last month in which over a hundred bugs were squashed Vulnerability-related.PatchVulnerability . The patch release impacts Vulnerability-related.PatchVulnerability Adobe Flash , Acrobat and Reader , Experience Manager , and Creative Cloud . Two of the vulnerabilities disclosed Vulnerability-related.DiscoverVulnerability in the release are described Vulnerability-related.DiscoverVulnerability as critical and affect Vulnerability-related.DiscoverVulnerability Acrobat and Reader . In July , Adobe issued Vulnerability-related.PatchVulnerability a security update which patched Vulnerability-related.PatchVulnerability a total of 112 vulnerabilities . The majority of bugs were uncovered Vulnerability-related.DiscoverVulnerability in Adobe Acrobat , but a critical code execution flaw was also resolved Vulnerability-related.PatchVulnerability in Adobe Flash . The critical bugs in this release impact Vulnerability-related.DiscoverVulnerability Adobe Acrobat 2017 , Acrobat DC , and Acrobat Reader DC on Windows and macOS machines . The tech giant says Vulnerability-related.DiscoverVulnerability that exploitation of the security flaws , an out of bounds write issue ( CVE-2018-12808 ) and an untrusted pointer dereference problem ( CVE-2018-12799 ) can lead to arbitrary code execution . The vulnerabilities resolved Vulnerability-related.PatchVulnerability include five bugs in Adobe Flash . An out of bounds read flaw ( CVE-2018-12824 ) , a security bypass error ( CVE-2018-12825 ) , two information disclosure vulnerabilities ( CVE-2018-12826 , CVE-2018-12827 ) , and a privilege escalation flaw ( CVE-2018-12828 ) have all been patched Vulnerability-related.PatchVulnerability . A reflected cross-site scripting flaw ( CVE-2018-12806 ) , input validation bypass ( CVE-2018-12807 ) , and cross-site scripting ( XSS ) bug ( CVE-2018-5005 ) have been patched Vulnerability-related.PatchVulnerability in Adobe Experience Manager versions 6.0 -- 6.4 on all platforms . If exploited Vulnerability-related.DiscoverVulnerability , the security flaws can facilitate sensitive information disclosure and data modification . In addition , a single bug in Adobe Creative Cloud Desktop affecting Vulnerability-related.DiscoverVulnerability versions 4.5.0.324 and earlier versions on Windows systems has been resolved Vulnerability-related.PatchVulnerability . The DLL hijacking vulnerability ( CVE-2018-5003 ) can be exploited Vulnerability-related.DiscoverVulnerability in order for an attacker to escalate privileges on an account . Adobe recommends that users update their software as quickly as possible . Researchers from Trend Micro 's Zero Day Initiative , Palo Alto Networks , Google Project Zero , TenCent , and Cognizant Technology Solutions , among others , were thanked for reporting Vulnerability-related.DiscoverVulnerability the bugs . On Tuesday , Microsoft 's latest round of patches tackled Vulnerability-related.PatchVulnerability a total of 60 vulnerabilities , 19 of which were deemed critical . Two severe security flaws resolved Vulnerability-related.PatchVulnerability in the update are zero-day vulnerabilities which are being actively exploited Vulnerability-related.DiscoverVulnerability in the wild .

Juniper Networks has released Vulnerability-related.PatchVulnerability its first cluster of security updates for 2019 , with the patches addressing Vulnerability-related.PatchVulnerability vulnerabilities in various products developed by the US networking equipment firm . Among the 19 security advisories released on Wednesday is a critical bug impacting Vulnerability-related.DiscoverVulnerability Junos OS , the FreeBSD-based operating system used in Juniper ’ s routers . CVE-2019-0006 affects Vulnerability-related.DiscoverVulnerability Junos OS versions 14.1X53 , 15.1 , 15.1X53 , where it was found Vulnerability-related.DiscoverVulnerability that a specially crafted HTTP packet could crash the fxpc daemon or could potentially lead to remote code execution ( RCE ) . Also marked as critical is CVE-2019-0007 , which addresses Vulnerability-related.PatchVulnerability a vulnerability in vMX series virtual routers running Junos OS 15.1 . “ The vMX series software uses a predictable IP ID Sequence Number , ” said Juniper . “ This leaves the system as well as clients connecting through the device susceptible to a family of attacks. ” Patches have also been released Vulnerability-related.PatchVulnerability for eight vulnerabilities in the libxml2 software library that impact Vulnerability-related.DiscoverVulnerability Junos OS . Eight additional security updates have been released Vulnerability-related.PatchVulnerability by Juniper that feature mitigations for high-level impact bugs , while a further six deal with less severe flaws . Multiple vulnerabilities were also discovered Vulnerability-related.DiscoverVulnerability in Juniper ’ s Advanced Threat Prevention ( ATP ) cloud security service . And finally , Juniper said nearly 40 vulnerabilities have been resolved Vulnerability-related.PatchVulnerability in the Junos Space Network Management Platform 18.3R1 and 18.4R1 by upgrading Vulnerability-related.PatchVulnerability third party components or fixing Vulnerability-related.PatchVulnerability internally discovered security vulnerabilities . Commenting on the advisories , the National Cybersecurity and Communications Integration Center ( NCCIC ) , said : “ Users and administrators should review Juniper ’ s Security Advisories webpage and apply the necessary updates . ”

Researchers at Germany-based security firm Cure53 have conducted a 32-day audit of the Network Time Protocol ( NTP ) and the NTPsec project and discovered Vulnerability-related.DiscoverVulnerability more than a dozen vulnerabilities . Experts identified Vulnerability-related.DiscoverVulnerability a total of 16 security-related issues , including 8 weaknesses that only affect Vulnerability-related.DiscoverVulnerability NTP and two that only impact Vulnerability-related.DiscoverVulnerability NTPsec , which is meant to be a secure , hardened and improved implementation of NTP . Cure53 has published separate reports focusing on the NTP and NTPsec problems . The Network Time Foundation addressed Vulnerability-related.PatchVulnerability the flaws earlier this month with the release of ntp-4.2.8p10 . Cure53 has classified Vulnerability-related.DiscoverVulnerability one vulnerability as being critical . CVE-2017-6460 , which only affects Vulnerability-related.DiscoverVulnerability NTP , has been described Vulnerability-related.DiscoverVulnerability as a stack-based buffer overflow that can be triggered by a malicious server when a client requests the restriction list . The flaw can be exploited Vulnerability-related.DiscoverVulnerability to cause a crash and possibly to execute arbitrary code . The security holes rated Vulnerability-related.DiscoverVulnerability by Cure53 as high severity are CVE-2017-6463 and CVE-2017-6464 , both of which can be exploited Vulnerability-related.DiscoverVulnerability for DoS attacks . It ’ s worth noting that while some of the vulnerabilities have been classified Vulnerability-related.DiscoverVulnerability as critical and high severity by Cure53 , NTP developers have only assigned Vulnerability-related.DiscoverVulnerability medium , low and informational-level severity ratings to the discovered flaws . Ntp-4.2.8p10 patches Vulnerability-related.PatchVulnerability a total of 15 vulnerabilities and also includes just as many non-security fixes and improvements . Of the 15 security holes resolved Vulnerability-related.PatchVulnerability in the latest version , 14 were discovered Vulnerability-related.DiscoverVulnerability by Cure53 , which also noticed Vulnerability-related.DiscoverVulnerability that a flaw initially patched Vulnerability-related.PatchVulnerability in December 2014 was reintroduced Vulnerability-related.DiscoverVulnerability in November 2016 . One of the vulnerabilities fixed Vulnerability-related.PatchVulnerability in ntp-4.2.8p10 was reported Vulnerability-related.DiscoverVulnerability by researchers at Cisco Talos . Experts identified Vulnerability-related.DiscoverVulnerability a DoS vulnerability affecting Vulnerability-related.DiscoverVulnerability the origin timestamp check functionality

Last week , Intel revealed Vulnerability-related.DiscoverVulnerability that a serious security flaw in some of its chips left potentially thousands of devices vulnerable to attackers . Then , security researchers revealed Vulnerability-related.DiscoverVulnerability the problem was way worse than anyone initially thought as the vulnerability could allow attackers to remotely `` hijack '' affected machines . It 's still not clear just how many devices are impacted Vulnerability-related.DiscoverVulnerability as Intel has't said , but some in the industry have put the number as high as 8,000 . Here 's a look at what you need to know and how to protect yourself . The vulnerability stems from something called Intel Active Management Technology , ( AMT ) , a technology that allows devices to be remotely managed to make it easier to update software and perform maintenance remotely . It 's a feature typically used by businesses that may be responsible for many devices that may not all be in the same place . Since the technology is integrated at a chip level , AMT can do a bit more than other software-enabled management tools . Using AMT 's capabilities , for instance , a system administrator could remotely access and control a computer 's mouse and keyboard , or turn on a computer that 's already been powered down . While those can be helpful capabilities for corporate IT departments to have , it 's obviously the type of access you 'd want locked down pretty tightly . And that 's just the problem . Security researchers found that AMT 's web portal can be accessed with just the user admin and literally any password or even no password at all . That 's why some have labeled it a `` hijacking '' flaw since anyone who exploits the vulnerability would be able to remotely control so many processes . Most importantly , the flaw does n't impact Vulnerability-related.DiscoverVulnerability every Intel chip out there . Since it 's rooted in Vulnerability-related.DiscoverVulnerability AMT , the vulnerability primarily affects Vulnerability-related.DiscoverVulnerability businesses , though , as Intel points out , some consumers use computers made for businesses . One of the easiest ways to check if you might be affected is to check that Intel sticker that comes on so many PCs . Look for a `` VPro '' logo as that indicates the presence of AMT . Of course , looking for a sticker is hardly foolproof . Intel has also released a downloadable detections guide , which will guide you through the process of checking your machines . You can find the detection guide here . Though Intel has long supplied Apple with chips for Macs , AMT is only present on processors in Windows-based machines , so all Macs are safe from this particular exploit . If you do have a machine that 's impacted by the security flaw , you 'll need to update your firmware as soon as possible . Intel has already created Vulnerability-related.PatchVulnerability a patch and is now waiting on manufacturers to make it available Vulnerability-related.PatchVulnerability . Some , including Dell , Lenovo , HP , and Fujitsu , have already rolled it out . You can find links to those over on Intel 's website , which will be updated Vulnerability-related.PatchVulnerability as more manufacturers release Vulnerability-related.PatchVulnerability updates .