Patch Tuesday

Breathe easy knowing we've got you covered with Patch Tuesday news and remediation recommendations every month!

210 Topics
211 Replies

210 Topics

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

Krebs article on the Ubiquiti hack

krebsonsecurity.com Whistleblower: Ubiquiti Breach “Catastrophic” — Krebs on Security On Jan. 11, Ubiquiti Inc. [NYSE:UI] — a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders and security cameras — disclosed that a breach involving a third-party cloud provider had exposed customer... Looks like they weren’t so honest about the true impact.

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (March 16th, 2021)

Welcome back to another week of security news and updates! Not surprisingly, we’re seeing more from the Microsoft Exchange situation and… another Chrome flaw. Check out the stories below - Microsoft releases mitigation tool for on-premises Exchange servers Microsoft’s new one-click Exchange On-Premises Mitigation Tool is now available and built as an interim integration for those that are either not familiar with the patching process or haven’t yet applied the Exchange security updates released on March 2nd. Roughly 82,000 servers remain vulnerable to the exploits. Microsoft has been clear that this is not supposed to be a replacement for the Exchange Server security update, but is to serve as a way to defend against the highest risks until they are able to patch the flaws. Downloading the tool will automatically mitigate CVE-2021-26855 with a URL rewrite configuration, run a malware scan, and reverse changes made by identified threats, Microsoft says. Six hacking groups suspected of

2 years ago

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

New mitigation tool for Exchange vulnerability

Details here: reddit r/exchangeserver - NEW! Microsoft Safety Scanner (MSERT) updated for Exchange... 155 votes and 22 comments so far on Reddit

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (March 9th, 2021)

Welcome back to another week of security news! Definitely some interesting stuff, check it out - Massive supply-chain cyberattack breaches several airlines The cyberattack on SITA, a nearly ubiquitious airline service provider, has compromised frequent-flyer data across many carriers. SITA has over 2,500 customers in the aviation industry and claims that its tech is used in 90% of international destinations. Malaysia Air and Singapore Airlines have already made headlines in recent days after alerting their customers they’ve been compromised as part of the attack. While the company didn’t comment specifically on the types of data exposed, it did include some personal data of airline passengers. Malicious apps on Google Play dropped banking Trojans on user devices Google has removed 10 apps from the Play Store which contained droppers for financial Trojans. Check Point Research (CPR) said in a blog post that the Android applications appear to have been submitted by the same threat actor

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (March 2nd, 2021)

Welcome back to the Security Wrap-Up! Last week was somewhat eventful, with a fairly hefty VMware vulnerability. Let’s check it out - VMware servers exposed to critical RCE bug Although this was mentioned in a thread last week, I thought it was worth discussing here as well. VMware has patched three vulnerabilities in its virtual-machine infrastructure for data centers, the most serious of which is a remote code execution (RCE) flaw in its vCenter Server management platform. The vulnerability could allow attackers to breach the external perimeter of an enterprise data center or leverage backdoors already installed on a system to find other vulnerable points of network entry to take over affected systems. The most critical of the flaws, which is being tracked as CVE-2021-21972, was found in a vCenter Server plugin for vROPs in the vSphere Client functionality, according to an advisory posted online Tuesday by VMware. VMware has advised customers to install all updates provided to affect

2 years ago

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

New bug makes VMware vCenter servers vulnerable to attack

ZDNet More than 6,700 VMware servers exposed online and vulnerable to major new bug... Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already. Sub headline: Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already.

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (February 23rd, 2021)

Hello! Sorry about the lack of security wrap-up last week, it was a bit of a doozy. But, I’m back this week with some interesting articles that might just send you down a rabbit hole (especially the last one) - FireEye links zero-day attacks on FTA servers and extortion campaign to FIN11 group Yesterday, FireEye has stated that the zero-day attacks in Accellion FTA servers have been carried out by a cybercrime group known as FIN11. During the attacks, hackers exploited four security flaws to attack FTA servers, install a web shell named DEWMODE, which the attackers then used to download files stored on the victim’s FTA appliances. “Out of approximately 300 total FTA clients, fewer than 100 were victims of the attack,” Accellion said in a press release. “Within this group, fewer than 25 appear to have suffered significant data theft.” Now, FireEye says that some of these 25 customers have now received ransom demands following the attacks on their FTA file-sharing servers. The attackers

2 years ago

Nic-AutomoxFormer Automox Employee

posted in Patch Tuesday

Solarwinds is revoking all digital certificates on March 8, 2021

https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Issues-due-to-revoked-code-signing-certificates?language=en_US reddit r/sysadmin - Solarwinds is revoking all digital certificates on March 8, 2021 414 votes and 112 comments so far on Reddit For those of you still on SolarWinds, heads up!

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (February 9th, 2021)

It’s been 0 weeks since we last mentioned SolarWinds… Plenty to talk about this week, let’s take a look - SolarWinds patches three newly discovered software vulnerabilities SolarWinds customers are being urged to apply newly released security patches after the discovery of three previously undisclosed severe vulnerabilities which could allow attackers to take control of Windows systems. The most severe vulnerability (CVE-2021-25275) could allow attackers to exploit a vulnerability in how Orion works with Microsoft Message Queue (MSMQ) to gain access to secured credentials in the backend and gain complete control over the entire Windows server. This could be used to steal information or add new admin-level users to Orion. A second vulnerability (CVE-2021-25274) could allow remote, unauthenticated users to run code in a way that allows complete control of the underlying Windows operating system. The third vulnerability (CVE-2021-25276) related to SolarWinds Serv-U FTP and allows anyone w

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (February 2nd, 2021)

We’re back this week with another Security Wrap-Up! And what would a wrap-up be without another mention of SolarWinds? We also revisit a topic from last week’s post and some interesting bugs you might want to know about - Follow-Up: SonicWall confirms zero-day vulnerability Last week, we mentioned a SonicWall breach that was thought to have originated from zero-day vulnerabilities. SonicWall has now confirmed that zero-day vulnerability affecting its SMA 100 Series. They have identified the vulnerable code and are developing a patch to be available by the end of day today, February 2nd. This vulnerability affects physical and virtual SMA 100 10.x devices (SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v). SMA firmware prior to 10.x is not affected. Mimecast the latest vendor victim in the SolarWinds hack A growing number of cybersecurity vendors have been targeted as part of the SolarWinds hack. The Mimecast certificate compromise reported earlier in January is now confirmed as part of

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

What you need to know about endpoint hardening for 2021

Over the last year, many organizations have had to make dramatic changes to their workforce dynamics. Coronavirus precautions have caused a spike in remote work. The shift in workforce operations has had many benefits for both employees and their employers, and it is expected that remote work will continue to be a valued solution for many organizations. And in 2021, effectively managing endpoints is more vital than ever. The continued trend of remote work puts a special focus on the integrity of an organization’s endpoints. Without corporate firewalls and other in-house security measures, end-user devices may be at an increased risk of being reached. Here’s a run-down on the top things you need to know to effectively manage your endpoints in 2021 (and check out the full blog post for an even more detailed breakdown): Malware and other threats are becoming more sophisticated Endpoints are often easy targets for these kinds of attacks. Limitations in endpoint visibility and low patchin

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Cybersecurity Considerations for 2021

2021 is poised to be a doozy of a year for cybercrime, with an estimated $6 trillion USD of damage this year alone. It’s hard to prepare for everything, but our team put together a list of the major cybersecurity risks and trends for 2021 to help get you started: Ransomware will remain prevalent, but the evolution of attacks likely won’t change The main goal of most cyber attacks is monetization and as long as attackers continue to successfully get businesses to pay to get their sensitive data or systems back online, threat actors will stay the course as the method is still very lucrative. The prevalence of cyber insurance will increase As cyber insurance increases, insurance companies will likely decrease coverage amounts and provide further stipulations on what or how much they cover as a result of ransomware attacks. Zero Trust models will be adopted more prevalently As companies rely more and more on a remote workforce, they’ll look at Zero Trust models that assume the perime

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (January 26th, 2021)

Bug in Cisco DNA Center leaves companies vulnerable to remote attack A fatal bug in the Cisco Digital Network Architecture (DNA) Center could open enterprise users to remote attack and takeover. The vulnerability is being tracked as CVE-2021-1257 and carries a CVSS vulnerability-severity score of 7.1. The DNA Center allows admins to provision and configure network devices and it uses artificial intelligence and machine learning to proactively monitor, troubleshoot, and optimize networks. Unfortunately, the web-based management interface used for accessing and using the Cisco DNA Center has insufficient CSRF protections in software versions prior to 2.1.1.0 and could force an end user to execute unwanted actions on a web application in which the person is currently authenticated. Thankfully, the vulnerability is fixed in Cisco DNA Center software releases 2.1.1.0, 2.1.2.0, 2.1.2.3, 2.1.2.4, and later. North Korean hackers have targeted security researchers via social media The Google Th

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (January 19th, 2021)

Happy Tuesday, everyone! We’re back with another Security Wrap-Up and yet another mention of the SolarWinds debacle - Windows 10 bug corrupts your hard drive on seeing an icon A new and peculiar Windows 10 bug has emerged that could corrupt a hard drive just by looking at an icon. Attackers can hide a specially crafted line inside a ZIP file, folder, or even a simple Windows shortcut. All a Windows 10 user needs to do is extract the ZIP file or simply look at a folder that contains a malicious shortcut and it will automatically trigger hard drive corruption. It turns out that the vulnerability has existed in Windows 10 for nearly three years. Others have also found that the vulnerability can occur if you simply paste the offending string into the address bar in a browser. FireEye releases tool for auditing networks for techniques used by SolarWinds hackers FireEye researchers released a report detailing the techniques used by SolarWinds hackers along with a free tool on GitHub named Az

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (January 12th, 2021)

Unfortunately, there was tons to talk about this week! If you haven’t yet done so, it may not be the worst idea to check Have I Been Pwned?… In the meantime, check out some of our security features for this week - 70TB of Parler users’ messages, videos, and posts leaked by security researchers A massive data scrape hit Parler after the social network went dark Monday morning following the shutdown by Amazon, Google, and Apple. The scrape includes user profile data, user information, and which users had administration rights for specific groups within the social network. The security researchers who collected the user data claim that the scraped posts are linked to accounts that posted them and some of the video/image data have geolocation information, which could prove valuable to law enforcement. All of the data collected only came from live or deleted posts within Parler, not private account settings. Ubiquiti tells customers to change passwords after security breach Another one bite

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (January 5th, 2021)

Time for the weekly security roundup! We have more important breaches to share and additional details on the massive SolarWinds attack - Secret backdoor discovered in Zyxel firewalls and AP controllers Over 100,000 Zyxel devices are potentially vulnerable to a secret backdoor caused by hardcoded credentials used to update firewall and AP controllers’ firmware. Niels Teusink of Dutch cybersecurity firm EYE discovered a secret hardcoded admin account in the latest 4.60 patch 0 firmware for some Zyxel devices. Teusink found that the account could be used to log into vulnerable devices over both SSH and the web interface. Since the SSL VPN inferface operates on the same port as the web interface, Teusink found that many users have allowed port 443 to be accessible on the Internet. Zyxel has released ZLD V4.60 patch 1 to remove the hardcoded credentials in vulnerable devices. Any devices using earlier firmware or SD-OS are not affected. COVID-19 vaccine scams appearing online, over text, an

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (December 29th, 2020)

Welcome to the last Security Wrap-Up of 2020! I don’t know about you, but I think it’s just about time for 2020 to be over. So let’s get to the news! Critical Google Docs bug has been patched Google has patched a bug in its feedback tool which would have allowed attackers to steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9th by Sreeram KL. Many of Google’s products, including Google Docs, come with a “Send Feedback” option that allows users to send feedback and the option to include a screenshot. The vulnerability lived within the iframe element that loads content from “feedback.googleusercontent.com” and allowed the attacker to modify the frame to an arbitrary, external website and hijack Google Docs screenshots which were meant to be uploaded to Google’s servers. Hackers amp up COVID-19 IP theft attacks Critical research of COVID-19 is being done across the globe, which means attackers are now look

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (December 22nd, 2020)

Happy Tuesday! This year has been a doozy, but I’m taking time this week to try and relax a little, I think we all need it. And whatever holiday you are celebrating (or not celebrating), I hope you can find your own time to rest and recover. Anyways, let’s go ahead and get into this week’s Security Wrap-Up - SolarWinds releases more details in a new report In an 8-K filing to the US Securities and Exchange commission, SolarWinds has given more details on its recent security troubles. The notice says that FireEye notified the network management biz’s CEO of a serious security issue on December 12th. But by then, the SUNBURST malware had already spread to 18,000 customers. A new report released last Friday show that hackers conducted a dry run in October of 2019. These October files, distributed to customers on October 10th, did not have a backdoor embedded in them and went undetected until this month. By conducting a dry run, hackers were able to determine if an intrusion would be detec

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (December 15th, 2020)

Welcome to another week of security news! There were plenty of security updates and vulnerabilities to discuss, but here are some of the top stories on my feed - Payment processing giant TSYS suffers ransomware attack After the ransomware attack on TSYS, the third-largest third-party payment processor for financial institutions in North America, reams of data have been stolen from the company and posted online, with the attackers promising to publish more in the coming days. But the company says the malware did not jeopardize card data, and that the incident was limited to administrative areas of its business. On December 8th, the cyber criminal gang responsible for deploying the Conti ransomware strain published more than 10 gigabytes of data that it claimed to have removed from TSYS’ networks. Microsoft Office 365 credentials under attack by fax “alert” emails Researchers are warning of a coordinated phishing attack that targeted “numerous” enterprise organizations last week. The

2 years ago

Brittany-AutomoxAutomox Employee

posted in Patch Tuesday

Security Wrap-Up (December 8th, 2020)

Welcome back to another edition of our Security Wrap-Up! We have plenty to discuss this week - Patched VMware bug under active attack The National Security Agency (NSA) has escalated concerns regarding the now-patched VMware Workspace One Access and VMware Identity Manager bugs, warning about a greater number of adversaries attempting to leverage the vulnerability to launch attacks to pilfer protected data and abuse shared authentication systems. VMware originally disclosed the vulnerability in late November, identifying it as an escalation-of-privileges flaw that impacts Workspace One Access and other platforms, for both Windows and Linux operating systems. (If you want more info, these are being tracked as CVE-2020-4006.) Amnesia:33 vulnerabilities impact millions of smart and industrial devices Security researchers disclosed 33 security flaws (called Amnesia:33) in four open-source TCP/IP libraries currently used inside the firmware of products from more than 150 vendors. Resear

2 years ago

Page 4 / 9

Patch Tuesday

Sign up

Login to the community

Scanning file for viruses.

This file cannot be downloaded