Zeppelin Ransomware
Technical Details Note: this advisory uses the MITRE ATT&CK® for Enterprise framework, version 11. See MITRE ATT&CK for Enterprise for all referenced tactics and techniques. Zeppelin ransomware is a derivative of the Delphi-based Vega malware family and functions as a Ransomware as a Service (RaaS). From 2019 through at least June 2022, actors have used this malware to target a wide range of businesses and critical infrastructure...
Read More
by CIRT Team
Threat Actors Exploiting CVE-2022-27925 chained with CVE-2022-37042 Against Zimbra Collaboration Suite
An authentication bypass Zimbra security vulnerability is actively exploited to compromise Zimbra Collaboration Suite (ZCS) email servers worldwide.According to threat intelligence firm Volexity, attackers have been abusing a ZCS remote code execution flaw tracked as CVE-2022-27925 requiring authentication with the help of an auth bypass bug (tracked as CVE-2022-37042). Description: CVE-2022-27925: Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP...
Read More
by CIRT Team
Linux Kernel eBPF local privilege escalation (CVE-2022-23222) vulnerability
Description:kernel/bpf/verifier.c in the Linux kernel through 5.15.14 allows local users to gain privileges because of the availability of pointer arithmetic via certain *_OR_NULL pointer types. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. Impact: A local attacker may exploit this issue to gain elevated root privileges on the affected system. Mitigation: Updates...
Read More
by CIRT Team
Microsoft Releases June 2022 Security Updates
Microsoft has released updates to address multiple vulnerabilities in Microsoft software. An attacker can exploit some of these vulnerabilities to take control of an affected system. CVE-2022-30190, also known as “Follina” — the RCE vulnerability in the Microsoft Windows Support Diagnostic Tool that was disclosed in late May and exploited in the wild — has now received patches for affected Windows systems. While Microsoft had...
Read More
by CIRT Team
Follina / CVE-2022-30190: New Microsoft Office zero-day
Security researchers have discovered a new Microsoft Office zero-day vulnerability that is being used in attacks to execute maliciously PowerShell commands via Microsoft Diagnostic Tool (MSDT) simply by opening a Word document. Workarounds: In Microsoft Defender’s Attack Surface Reduction (ASR) activating the rule “Block all Office applications from creating child processes” in Block mode will prevent this from being exploited.[https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-all-office-applications-from-creating-child-processes] Disable the MSDT URL Protocol....
Read More
by CIRT Team
CVE-2022-1388 : BIG-IP iControl REST vulnerability
CVE-2022-1388: On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all 12.1.x and 11.6.x versions, undisclosed requests may bypass iControl REST authentication. Impact: This vulnerability may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands,...
Read More
by CIRT Team
Oracle Quarterly Critical Patches Issued January 18, 2021
DESCRIPTION: Multiple vulnerabilities have been discovered in Oracle products, which could allow for remote code execution. SYSTEM AFFECTED: * Agile Product Lifecycle Management Integration Pack for Oracle E-Business Suite, version 3.6 * Application Performance Management, versions 13.4.1.0, 13.5.1.0 * Big Data Spatial and Graph, versions prior to 23.1 * Enterprise Manager Base Platform, versions 13.4.0.0, 13.5.0.0 * Enterprise Manager Ops Center, version 12.4.0.0 * Fujitsu...
Read More
by CIRT Team
Multiple Vulnerabilities in Mozilla Firefox and Thunderbird Could Allow for Arbitrary Code Execution
DESCRIPTION: Multiple vulnerabilities have been discovered in Mozilla Firefox, Firefox Extended Support Release (ESR), and Thunderbird, the most severe of which could allow for arbitrary code execution. * Mozilla Firefox is a web browser used to access the Internet. * Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations. * Mozilla Thunderbird is an email client. Successful...
Read More
by CIRT Team
Multiple Vulnerabilities in Google Android OS Could Allow for Escalation of Privilege
DESCRIPTION: Multiple vulnerabilities have been discovered in the Google Android operating system (OS), the most severe of which could allow for escalation of privilege. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for escalation of privilege. Depending on the privileges associated with...
Read More
by CIRT Team
Multiple Vulnerabilities in Cisco Products Could Allow for Arbitrary Code Execution
DESCRIPTION: Multiple vulnerabilities have been discovered in Cisco Products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow an unauthenticated, remote attacker to execute code on the affected systems. Depending on the privileges associated with the targeted user, an attacker could then install programs; view, change, or delete data; or create new...
Read More
