Skip to main content

Worklets
Product Roadmap
Automox Console
Talk to Support
Start Free Trial

Community Hub
Forum
Industry News

Industry News

Let's talk shop!

324 Topics

Recently active

Most replies Most views Newest first

posted in Vulnerabilities

Patch Tuesday Rundown - June 2021

Get ya Patch Tuesday Rundown here! As we do every month, we’ve put together a summary of what you can find in this month’s Patch Tuesday updates and what it might mean for you. June was about in line with what we found from Microsoft in last month’s Patch Tuesday with 49 vulnerabilities addressed vs. 55 in May. But, it represents 33% fewer vulnerabilities on average for each month so far this year. Of these 49 vulnerabilities, 5 were rated as critical, one more than last month, and 52% lower on average. Unfortunately, 6 vulnerabilities are being actively exploited in the wild, one more than the highest monthly number seen so far this year. These 6 actively exploited vulnerabilities can enable an attacker to gain control of a system, illegally gain critical information, and compromise the security of infrastructure through a vulnerable system. While Automox recommends that all critical vulnerabilities are patched within a 72 hour window, the fact that many of this month’s critical vulne

posted in Patch Tuesday

Security Wrap-Up (June 2nd, 2021)

Here we are with this week’s Security Wrap-Up! My brain thought yesterday was Monday for almost the entire day, so my apologies for getting this one out a day late. But, we are here with some really intriguing security updates, including a deep-dive into PDF security. Let’s take a look! HPE fixes critical zero-day in server management software Hewlett Packard Enterprise (HPE) has patched a critical zero-day remote code execution (RCE) flaw in its HPE Systems Insight Manager (SIM) software for Windows that it originally disclosed in December. HPE SIM is a tool that enables remote support automation and management for a variety of HPE servers, including the ProLiant Gen9 and Gen10 along with some storage and networking products. Back on April 20th, HPE did issue an earlier SIM hotfix update kit that resolves the vulnerability. It’s an extremely high-risk flaw that can enable attackers with no privileges to remotely execute code within the context of HPE SIM’s hpsimsvc.exe process. The vu

posted in Patch Tuesday

Security Wrap-Up (May 25th, 2021)

Sorry I missed last week, but we’re back this week with more security updates! macOS Big Sur 11.4 addresses vulnerability that could let attackers take secret screenshots macOS Big Sur 11.4 was released on Monday morning and addressed a zero-day vulnerability that could allow attackers to piggyback off of apps like Zoom, secretly taking screenshots and recording the screen. This security issue would allow Privacy preferences to be bypassed, providing an attacker with Full Disk Access, Screen Recording, and other permissions without a user’s content. Four Android bugs being exploited in the wild Google updated its May 3rd Android security bulletin on Wednesday to say that there are “indications” that four of the 50 vulnerabilities may be targeted and exploited in the wild. These include Qualcomm GPU vulnerabilities CVE-2021-1905 & CVE-2021-1906 and ARM Mali GPU vulnerabilities CVE-2021-28663 & CVE-2021-28664. Google Android exploits are a rarity, with these four bugs making up t

posted in Patch Tuesday

Security Wrap-Up (May 11th, 2021)

This week’s security wrap-up is full of plenty of interesting updates and discoveries - Qualcomm chip bug opens Android devices to eavesdropping A vulnerability in a 5G modem data device could allow mobile hackers to remotely target Android users by injecting malicious code into a phone’s modem, gaining the ability to execute code, access mobile users’ call histories and text messages, and eavesdrop on phone calls. The bug (CVE-2020-11292) exists in the Qualcomm Mobile Station Modem (MSM) Interface, known as QMI. MSMs are systems on chips designed by Qualcomm and QMI is a proprietary protocol used to communicate between software components in the modem and other peripheral subsystems. QMI is currently being used in roughly 30% of the world’s handsets. Attackers can exploit the bug to attack a mobile device remotely via a malicious or trojanized Android application. Cisco fixes critical SD-WAN vManage and HyperFlex HX security bugs Cisco SD-WAN vManage Software vulnerabilities patched b

posted in Vulnerabilities

Patch Tuesday Rundown - May 2021

Sorry this post is coming in a bit late, but I’m finally back with the Patch Tuesday Rundown for May! May’s Patch Tuesday saw only 55 security fixes compared to the 108 tallied in the month of April. We’re currently tracking 4 critical vulnerabilities, none of which are being exploited in the wild to the best of our knowledge and vendor communications. On the Microsoft side, CVE-2021-26419 is a critical remote code execution vulnerability that impacts Internet Explorer 11 and 9 running on multiple versions of Microsoft Windows and Windows Server. In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit the vulnerabilty through Internet Explorer and then convince a user to view the website. We also see an HTTP Protocol Stack remote code execution vulnerability (CVE-2021-31166) and a Microsoft Windows Object Linking (OLE) Automation execution vulnerability (CVE-2021-31194). For Adobe, they’ve released a trove of 12 new security bullet

posted in Patch Tuesday

Security Wrap-Up (May 4th, 2021)

May the 4th be with you! Unfortunately, the Dark Side has been able to wreak some havoc across a few tech giants, so let’s take a look at the latest in security news - Apple fixes zero-day security bugs under active attack Yesterday, Apple released a set of unscheduled updates for iOS, macOS, and watchOS, issuing out-of-band patches for critical security issues affecting iPad, iPhone, and iPod, which could allow remote code execution (RCE) and other attacks, compromising users’ systems. Three of these are zero-day flaws, while one is an expanded patch for a fourth vulnerability. The three zero-day bugs include: CVE-2021-30665 (a critical memory-corruption issue in the Safari WebKit engine where “processing maliciously crafted web content may lead to arbitrary code execution” was addressed with improved state management), CVE-2021-30663 (an integer overflow, which can also lead to RCE), and CVE-2021-30666 (a buffer overflow issue addressed with improved memory handling). The fourth bug

posted in Patch Tuesday

Security Wrap-Up (April 27th, 2021)

Hello and welcome back to a new week of the Security Wrap-Up! There are some great security updates on this week’s list and a must-patch update for macOS. Check it out - Nvidia warns of severe security bugs in GPU driver, vGPU software Nvidia has disclosed a group of security vulnerabilities in the Nvidia graphics processing unit (GPU) display driver, which could cause privilege-escalation attacks, arbitrary code execution, denial of service, and information disclosure. Out of the five bugs in the GPU display driver, the most severe is CVE-2021-1074, which rates 7.5 out of 10 on the CVSS vulnerability scale. This vulnerability exists within the display driver’s installer and allows an attacker with local system access to replace an application source with malicious files, potentially leading to code execution, escalation of privileges, denial of service, or information disclosure. The link above will show you the remaining four bugs (CVE-2021-1075, CVE-2021-2076, CVE-2021-1077, and CVE

posted in Patch Tuesday

Security Wrap-Up (April 20th, 2021)

We’re here with another week of security news and updates for you! There’s some great info to be had, so let’s get started - Google Project Zero cuts bug disclosure timeline to a 30-day grace period In a new disclosure policy revealed last week, Google Project Zero will give organizations a 30-day grace period to patch zero-day flaws. The goal of this policy change is to encourage faster patch adoption. Project Zero is changing its previous tactic slightly, delaying disclosure of technical details of the vulnerability until 30 days after the patch is issued, if that patch is created within the 90-day period. Moving to this “90+30 model” will allow researchers and the industry as a whole to “decouple time to patch from patch adoption time, reduce the contentious debate around attacker/defender trade-offs and the sharing of technical details, while advocating to reduce the amount of time that end users are vulnerable to known attacks,” explained Project Zero’s Tim Willis in a recent blog

posted in Patch Tuesday

How safe is your critical infrastructure?

Virtually every business and service organization has critical systems that serve as the backbone of their operations. Any disruption could have disastrous consequences that could cost a lot to remediate or put lives at risk. While your organization might not be responsible for critical infrastructure that supports whole cities, you still have assets and data that need protection, such as patient records and systems, customer financial records, student records, inventory data, and more. Hackers have figured out that smaller organizations and small municipalities have not put the money into protecting themselves, or are using older systems that are unsupported, with outdated software for which no updates are available. Whether you’re in a large corporation or a small organization, there are quite a few cyber-hygiene guidelines you can follow to prevent a major incident: Prioritize updates by severity and environmental exposure as they become available Limit account permissions in accor

posted in Vulnerabilities

Patch Tuesday Rundown - April 2021

Yesterday marked the fourth Patch Tuesday of 2021! April’s Patch Tuesday yielded 108 new Microsoft security fixes, delivering the highest monthly total for 2021 (so far) and showing a return to the 100+ totals we consistently saw in 2020. Included in this month are 19 critical vulnerabilities and a high-severity zero-day that’s currently being exploited in the wild, CVE-2021-28310. This vulnerability is a locally exploited Windows Win32K elevation of privilege bug. To exploit it, an attacker would first have to log on to the system, then run a specially crafted application. The exploitation of this vulnerability would allow an attacker to execute code in the context of the kernel and gain SYSTEM privileges, allowing the attacker access to critical Windows components and information. Not only was Microsoft subject to a number of security fixes, Adobe released four security updates covering seven critical vulnerabilities across Adobe Photoshop, Adobe Digital Editions, Adobe Bridge, and R

posted in Vulnerabilities

April 2021 Patch Tuesday Webinar Recap

If you weren’t able to attend our Patch Tuesday Webinar or just want a refresher on everything that was discussed, we have a recap available here. Join Justin Knapp, Automox’s Product Marketing Manager, as he discusses the latest vulnerabilities identified in this Patch Tuesday roundup!

posted in Patch Tuesday

Security Wrap-Up (April 13th, 2021)

Welcome to another week of the Security Wrap-Up! We’ve got a couple of RCE vulnerabilities and other security issues to share - Chrome zero-day exploit posted on Twitter Security researcher, Rajvardhan Agarwal, has dropped working exploit code on Twitter for a zero-day remote code execution (RCE) vulnerability, which affects the current versions of Google Chrome and potentially other browsers, like Microsoft Edge, that use the Chromium framework. The latest version of the Chrome V8 JavaScript engine patches the flaw, but it has not yet been integrated into official releases of downstream Chromium-based browsers such as Chrome, Edge, and others, leaving them potentially vulnerable to attacks. Google is expected to release a new Chrome version sometime on Tuesday, but it’s currently unclear if patches for the bug will be included. Critical Zoom vulnerability triggers remote code execution without user input Yes, yet another remote code execution (RCE) flaw has been discovered! This time

posted in Patch Tuesday

Security Wrap-Up (April 6th, 2021)

Welcome to another Security Wrap-Up! This week, we’re covering some more updates from the Ubiquiti saga and some other interesting security updates. Let’s take a look - Apple Mail zero-click security vulnerability allows email snooping A zero-click security vulnerability in Apple’s macOS Mail would allow a cyberattacker to add or modify any arbitrary file inside Mail’s sandbox environment, leading to a range of attack types, including - mail redirects and the ability to change the victim’s configuration. The bug was patched in macOS Mojave 10.14.6, macOS High Sierra 10.13.6, and macOS 10.15.5, so users should upgrade accordingly. Researcher Mikko Kenttälä discovered the bug (CVE-2020-9922) by sending test messages and following Mail process syscalls. QNAP NAS devices still facing huge number of online attacks Users are reporting that their QNAP NAS devices are being subject to brute-force attacks. Late last year, QNAP fixed a cross-site scripting vulnerability, and issued patches to ne

posted in Patch Tuesday

Security Wrap-Up (March 30th, 2021)

Welcome back to the last Security Wrap-Up of March! Some interesting pieces of news to share, so let’s take a look - Another critical RCE flaw discovered in SolarWinds Orion platform On Thursday, SolarWinds released a new update to its Orion networking monitoring tool with fixes for four security vulnerabilities, including two weaknesses that could be exploited by an authenticated attacker to achieve remote code execution (RCE). Most notable is a JSON deserialization flaw that allows an authenticated user to execute arbitrary code via the test alert actions features available in the Orion Web Console. The second issue concerns a high-risk vulnerability that could be leveraged by an adversary to achieve RCE in the Orion Job Scheduler. The update also handles two additional bugs, including a high-severity stored cross-site scripting (XSS) vulnerability in the “add custom tab” within customize view page and a reverse tabnabbing and open redirect vulnerability in the custom menu item optio

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

Krebs article on the Ubiquiti hack

krebsonsecurity.com Whistleblower: Ubiquiti Breach “Catastrophic” — Krebs on Security On Jan. 11, Ubiquiti Inc. [NYSE:UI] — a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders and security cameras — disclosed that a breach involving a third-party cloud provider had exposed customer... Looks like they weren’t so honest about the true impact.

posted in Patch Tuesday

Security Wrap-Up (March 16th, 2021)

Welcome back to another week of security news and updates! Not surprisingly, we’re seeing more from the Microsoft Exchange situation and… another Chrome flaw. Check out the stories below - Microsoft releases mitigation tool for on-premises Exchange servers Microsoft’s new one-click Exchange On-Premises Mitigation Tool is now available and built as an interim integration for those that are either not familiar with the patching process or haven’t yet applied the Exchange security updates released on March 2nd. Roughly 82,000 servers remain vulnerable to the exploits. Microsoft has been clear that this is not supposed to be a replacement for the Exchange Server security update, but is to serve as a way to defend against the highest risks until they are able to patch the flaws. Downloading the tool will automatically mitigate CVE-2021-26855 with a URL rewrite configuration, run a malware scan, and reverse changes made by identified threats, Microsoft says. Six hacking groups suspected of

posted in Vulnerabilities

Patch Tuesday Rundown - March 2021

March brought us back to a more exciting time, compared to February. Microsoft has addressed 89 new vulnerabilities this month, representing a 60% increase from the previous month. Of this total, 14 are rated as “critical” with 5 that are being actively being exploited in the wild. And you didn’t think I’d miss the whole Microsoft Exchange incident, did you? 4 of those exploited vulnerabilties are specific to Microsoft Exchange Server. These Microsoft Exchange vulnerabilities were important enough for the “CISA,” the US Cybersecurity and Infrastructure Security Agency, to issue an emergency directive following the release of fixes for these zero-day vulnerabilities in Microsoft Exchange. In the midst of more severe vulnerabilities, Adobe had a modest release of three security updates addressing a handful of vulnerabilities, 5 of which are critical affecting Creative Cloud Desktop Application (APSB21-18), Adobe Connect (APSB21-19), and Adobe Framemaker (APSB21-14). Admins contending wit

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

New mitigation tool for Exchange vulnerability

Details here: reddit r/exchangeserver - NEW! Microsoft Safety Scanner (MSERT) updated for Exchange... 155 votes and 22 comments so far on Reddit

posted in Patch Tuesday

Security Wrap-Up (March 9th, 2021)

Welcome back to another week of security news! Definitely some interesting stuff, check it out - Massive supply-chain cyberattack breaches several airlines The cyberattack on SITA, a nearly ubiquitious airline service provider, has compromised frequent-flyer data across many carriers. SITA has over 2,500 customers in the aviation industry and claims that its tech is used in 90% of international destinations. Malaysia Air and Singapore Airlines have already made headlines in recent days after alerting their customers they’ve been compromised as part of the attack. While the company didn’t comment specifically on the types of data exposed, it did include some personal data of airline passengers. Malicious apps on Google Play dropped banking Trojans on user devices Google has removed 10 apps from the Play Store which contained droppers for financial Trojans. Check Point Research (CPR) said in a blog post that the Android applications appear to have been submitted by the same threat actor

posted in Patch Tuesday

Security Wrap-Up (March 2nd, 2021)

Welcome back to the Security Wrap-Up! Last week was somewhat eventful, with a fairly hefty VMware vulnerability. Let’s check it out - VMware servers exposed to critical RCE bug Although this was mentioned in a thread last week, I thought it was worth discussing here as well. VMware has patched three vulnerabilities in its virtual-machine infrastructure for data centers, the most serious of which is a remote code execution (RCE) flaw in its vCenter Server management platform. The vulnerability could allow attackers to breach the external perimeter of an enterprise data center or leverage backdoors already installed on a system to find other vulnerable points of network entry to take over affected systems. The most critical of the flaws, which is being tracked as CVE-2021-21972, was found in a vCenter Server plugin for vROPs in the vSphere Client functionality, according to an advisory posted online Tuesday by VMware. VMware has advised customers to install all updates provided to affect

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

New bug makes VMware vCenter servers vulnerable to attack

ZDNet More than 6,700 VMware servers exposed online and vulnerable to major new bug... Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already. Sub headline: Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already.

posted in Patch Tuesday

Security Wrap-Up (February 23rd, 2021)

Hello! Sorry about the lack of security wrap-up last week, it was a bit of a doozy. But, I’m back this week with some interesting articles that might just send you down a rabbit hole (especially the last one) - FireEye links zero-day attacks on FTA servers and extortion campaign to FIN11 group Yesterday, FireEye has stated that the zero-day attacks in Accellion FTA servers have been carried out by a cybercrime group known as FIN11. During the attacks, hackers exploited four security flaws to attack FTA servers, install a web shell named DEWMODE, which the attackers then used to download files stored on the victim’s FTA appliances. “Out of approximately 300 total FTA clients, fewer than 100 were victims of the attack,” Accellion said in a press release. “Within this group, fewer than 25 appear to have suffered significant data theft.” Now, FireEye says that some of these 25 customers have now received ransom demands following the attacks on their FTA file-sharing servers. The attackers

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

Solarwinds is revoking all digital certificates on March 8, 2021

https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Issues-due-to-revoked-code-signing-certificates?language=en_US reddit r/sysadmin - Solarwinds is revoking all digital certificates on March 8, 2021 414 votes and 112 comments so far on Reddit For those of you still on SolarWinds, heads up!

posted in Vulnerabilities

Patch Tuesday Rundown - February 2021

This month’s Patch Tuesday is a bit less tumultuous compared to last month, with 56 new vulnerabilities, including 11 critical updates, from Microsoft. While the overall number of vulnerabilities fixed this month is relatively low, there is a zero-day (CVE-2021-1732) being exploited in the wild. Additionally, 11 of the Critical rated updates fix Remote Code Execution vulnerabilities. Adobe has also released fixes for numerous vulnerabilities across Dreamweaver, Illustrator, Photoshop, Magneto, Acrobat, and Reader. APSB21-09 specifically addresses updates for Adobe Reader that are currently being exploited in the wild. You can find a list of all of the Patch Tuesday updates from Firefox, Adobe, Apple, and Microsoft in our Patch Tuesday Index. Our Automox experts also put together their monthly breakdown of this month’s Patch Tuesday releases here. Lastly, it’s not too late to register for our monthly Patch Tuesday Webinar happening tomorrow at 12pm ET!

posted in Patch Tuesday

Security Wrap-Up (February 9th, 2021)

It’s been 0 weeks since we last mentioned SolarWinds… Plenty to talk about this week, let’s take a look - SolarWinds patches three newly discovered software vulnerabilities SolarWinds customers are being urged to apply newly released security patches after the discovery of three previously undisclosed severe vulnerabilities which could allow attackers to take control of Windows systems. The most severe vulnerability (CVE-2021-25275) could allow attackers to exploit a vulnerability in how Orion works with Microsoft Message Queue (MSMQ) to gain access to secured credentials in the backend and gain complete control over the entire Windows server. This could be used to steal information or add new admin-level users to Orion. A second vulnerability (CVE-2021-25274) could allow remote, unauthenticated users to run code in a way that allows complete control of the underlying Windows operating system. The third vulnerability (CVE-2021-25276) related to SolarWinds Serv-U FTP and allows anyone w

1
...
5
6
7
8
9
10
11
...
13

Page 8 / 13

Powered by Gainsight

Terms & Conditions Cookie settings

Sign up

Already have an account? Login

Username *

E-mail address *

Country *

Password *

I accept the terms & conditions

loginBox.register.email_repeat

Login to the community

No account yet? Create an account

Username or Email

Password

Remember me

Forgot password?

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK