Patch Tuesday

Breathe easy knowing we've got you covered with Patch Tuesday news and remediation recommendations every month!

  • 227 Topics
  • 227 Replies

227 Topics

Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (March 9th, 2021)

Welcome back to another week of security news! Definitely some interesting stuff, check it out - Massive supply-chain cyberattack breaches several airlines The cyberattack on SITA, a nearly ubiquitious airline service provider, has compromised frequent-flyer data across many carriers. SITA has over 2,500 customers in the aviation industry and claims that its tech is used in 90% of international destinations. Malaysia Air and Singapore Airlines have already made headlines in recent days after alerting their customers they’ve been compromised as part of the attack. While the company didn’t comment specifically on the types of data exposed, it did include some personal data of airline passengers. Malicious apps on Google Play dropped banking Trojans on user devices Google has removed 10 apps from the Play Store which contained droppers for financial Trojans. Check Point Research (CPR) said in a blog post that the Android applications appear to have been submitted by the same threat actor

1
Nic-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (March 2nd, 2021)

Welcome back to the Security Wrap-Up! Last week was somewhat eventful, with a fairly hefty VMware vulnerability. Let’s check it out - VMware servers exposed to critical RCE bug Although this was mentioned in a thread last week, I thought it was worth discussing here as well. VMware has patched three vulnerabilities in its virtual-machine infrastructure for data centers, the most serious of which is a remote code execution (RCE) flaw in its vCenter Server management platform. The vulnerability could allow attackers to breach the external perimeter of an enterprise data center or leverage backdoors already installed on a system to find other vulnerable points of network entry to take over affected systems. The most critical of the flaws, which is being tracked as CVE-2021-21972, was found in a vCenter Server plugin for vROPs in the vSphere Client functionality, according to an advisory posted online Tuesday by VMware. VMware has advised customers to install all updates provided to affect

1
Brittany-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Patch Tuesday

New bug makes VMware vCenter servers vulnerable to attack

ZDNet More than 6,700 VMware servers exposed online and vulnerable to major new bug... Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already. Sub headline: Proof-of-concept exploit code has been published online earlier today, and active scans for vulnerable VMware systems have been detected already.

0
Nic-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (February 23rd, 2021)

Hello! Sorry about the lack of security wrap-up last week, it was a bit of a doozy. But, I’m back this week with some interesting articles that might just send you down a rabbit hole (especially the last one) - FireEye links zero-day attacks on FTA servers and extortion campaign to FIN11 group Yesterday, FireEye has stated that the zero-day attacks in Accellion FTA servers have been carried out by a cybercrime group known as FIN11. During the attacks, hackers exploited four security flaws to attack FTA servers, install a web shell named DEWMODE, which the attackers then used to download files stored on the victim’s FTA appliances. “Out of approximately 300 total FTA clients, fewer than 100 were victims of the attack,” Accellion said in a press release. “Within this group, fewer than 25 appear to have suffered significant data theft.” Now, FireEye says that some of these 25 customers have now received ransom demands following the attacks on their FTA file-sharing servers. The attackers

0
Brittany-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Patch Tuesday

Solarwinds is revoking all digital certificates on March 8, 2021

https://support.solarwinds.com/SuccessCenter/s/article/SolarWinds-Issues-due-to-revoked-code-signing-certificates?language=en_US reddit r/sysadmin - Solarwinds is revoking all digital certificates on March 8, 2021 414 votes and 112 comments so far on Reddit For those of you still on SolarWinds, heads up!

0
Nic-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (February 9th, 2021)

It’s been 0 weeks since we last mentioned SolarWinds… Plenty to talk about this week, let’s take a look - SolarWinds patches three newly discovered software vulnerabilities SolarWinds customers are being urged to apply newly released security patches after the discovery of three previously undisclosed severe vulnerabilities which could allow attackers to take control of Windows systems. The most severe vulnerability (CVE-2021-25275) could allow attackers to exploit a vulnerability in how Orion works with Microsoft Message Queue (MSMQ) to gain access to secured credentials in the backend and gain complete control over the entire Windows server. This could be used to steal information or add new admin-level users to Orion. A second vulnerability (CVE-2021-25274) could allow remote, unauthenticated users to run code in a way that allows complete control of the underlying Windows operating system. The third vulnerability (CVE-2021-25276) related to SolarWinds Serv-U FTP and allows anyone w

2
Nic-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (February 2nd, 2021)

We’re back this week with another Security Wrap-Up! And what would a wrap-up be without another mention of SolarWinds? We also revisit a topic from last week’s post and some interesting bugs you might want to know about - Follow-Up: SonicWall confirms zero-day vulnerability Last week, we mentioned a SonicWall breach that was thought to have originated from zero-day vulnerabilities. SonicWall has now confirmed that zero-day vulnerability affecting its SMA 100 Series. They have identified the vulnerable code and are developing a patch to be available by the end of day today, February 2nd. This vulnerability affects physical and virtual SMA 100 10.x devices (SMA 200, SMA 210, SMA 400, SMA 410, and SMA 500v). SMA firmware prior to 10.x is not affected. Mimecast the latest vendor victim in the SolarWinds hack A growing number of cybersecurity vendors have been targeted as part of the SolarWinds hack. The Mimecast certificate compromise reported earlier in January is now confirmed as part of

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

What you need to know about endpoint hardening for 2021

Over the last year, many organizations have had to make dramatic changes to their workforce dynamics. Coronavirus precautions have caused a spike in remote work. The shift in workforce operations has had many benefits for both employees and their employers, and it is expected that remote work will continue to be a valued solution for many organizations. And in 2021, effectively managing endpoints is more vital than ever. The continued trend of remote work puts a special focus on the integrity of an organization’s endpoints. Without corporate firewalls and other in-house security measures, end-user devices may be at an increased risk of being reached. Here’s a run-down on the top things you need to know to effectively manage your endpoints in 2021 (and check out the full blog post for an even more detailed breakdown): Malware and other threats are becoming more sophisticated Endpoints are often easy targets for these kinds of attacks. Limitations in endpoint visibility and low patchin

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Cybersecurity Considerations for 2021

2021 is poised to be a doozy of a year for cybercrime, with an estimated $6 trillion USD of damage this year alone. It’s hard to prepare for everything, but our team put together a list of the major cybersecurity risks and trends for 2021 to help get you started: Ransomware will remain prevalent, but the evolution of attacks likely won’t change The main goal of most cyber attacks is monetization and as long as attackers continue to successfully get businesses to pay to get their sensitive data or systems back online, threat actors will stay the course as the method is still very lucrative. The prevalence of cyber insurance will increase As cyber insurance increases, insurance companies will likely decrease coverage amounts and provide further stipulations on what or how much they cover as a result of ransomware attacks. Zero Trust models will be adopted more prevalently As companies rely more and more on a remote workforce, they’ll look at Zero Trust models that assume the perime

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (January 26th, 2021)

Bug in Cisco DNA Center leaves companies vulnerable to remote attack A fatal bug in the Cisco Digital Network Architecture (DNA) Center could open enterprise users to remote attack and takeover. The vulnerability is being tracked as CVE-2021-1257 and carries a CVSS vulnerability-severity score of 7.1. The DNA Center allows admins to provision and configure network devices and it uses artificial intelligence and machine learning to proactively monitor, troubleshoot, and optimize networks. Unfortunately, the web-based management interface used for accessing and using the Cisco DNA Center has insufficient CSRF protections in software versions prior to 2.1.1.0 and could force an end user to execute unwanted actions on a web application in which the person is currently authenticated. Thankfully, the vulnerability is fixed in Cisco DNA Center software releases 2.1.1.0, 2.1.2.0, 2.1.2.3, 2.1.2.4, and later. North Korean hackers have targeted security researchers via social media The Google Th

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (January 19th, 2021)

Happy Tuesday, everyone! We’re back with another Security Wrap-Up and yet another mention of the SolarWinds debacle - Windows 10 bug corrupts your hard drive on seeing an icon A new and peculiar Windows 10 bug has emerged that could corrupt a hard drive just by looking at an icon. Attackers can hide a specially crafted line inside a ZIP file, folder, or even a simple Windows shortcut. All a Windows 10 user needs to do is extract the ZIP file or simply look at a folder that contains a malicious shortcut and it will automatically trigger hard drive corruption. It turns out that the vulnerability has existed in Windows 10 for nearly three years. Others have also found that the vulnerability can occur if you simply paste the offending string into the address bar in a browser. FireEye releases tool for auditing networks for techniques used by SolarWinds hackers FireEye researchers released a report detailing the techniques used by SolarWinds hackers along with a free tool on GitHub named Az

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (January 12th, 2021)

Unfortunately, there was tons to talk about this week! If you haven’t yet done so, it may not be the worst idea to check Have I Been Pwned?… In the meantime, check out some of our security features for this week - 70TB of Parler users’ messages, videos, and posts leaked by security researchers A massive data scrape hit Parler after the social network went dark Monday morning following the shutdown by Amazon, Google, and Apple. The scrape includes user profile data, user information, and which users had administration rights for specific groups within the social network. The security researchers who collected the user data claim that the scraped posts are linked to accounts that posted them and some of the video/image data have geolocation information, which could prove valuable to law enforcement. All of the data collected only came from live or deleted posts within Parler, not private account settings. Ubiquiti tells customers to change passwords after security breach Another one bite

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (January 5th, 2021)

Time for the weekly security roundup! We have more important breaches to share and additional details on the massive SolarWinds attack - Secret backdoor discovered in Zyxel firewalls and AP controllers Over 100,000 Zyxel devices are potentially vulnerable to a secret backdoor caused by hardcoded credentials used to update firewall and AP controllers’ firmware. Niels Teusink of Dutch cybersecurity firm EYE discovered a secret hardcoded admin account in the latest 4.60 patch 0 firmware for some Zyxel devices. Teusink found that the account could be used to log into vulnerable devices over both SSH and the web interface. Since the SSL VPN inferface operates on the same port as the web interface, Teusink found that many users have allowed port 443 to be accessible on the Internet. Zyxel has released ZLD V4.60 patch 1 to remove the hardcoded credentials in vulnerable devices. Any devices using earlier firmware or SD-OS are not affected. COVID-19 vaccine scams appearing online, over text, an

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (December 29th, 2020)

Welcome to the last Security Wrap-Up of 2020! I don’t know about you, but I think it’s just about time for 2020 to be over. So let’s get to the news! Critical Google Docs bug has been patched Google has patched a bug in its feedback tool which would have allowed attackers to steal screenshots of sensitive Google Docs documents simply by embedding them in a malicious website. The flaw was discovered on July 9th by Sreeram KL. Many of Google’s products, including Google Docs, come with a “Send Feedback” option that allows users to send feedback and the option to include a screenshot. The vulnerability lived within the iframe element that loads content from “feedback.googleusercontent.com” and allowed the attacker to modify the frame to an arbitrary, external website and hijack Google Docs screenshots which were meant to be uploaded to Google’s servers. Hackers amp up COVID-19 IP theft attacks Critical research of COVID-19 is being done across the globe, which means attackers are now look

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (December 22nd, 2020)

Happy Tuesday! This year has been a doozy, but I’m taking time this week to try and relax a little, I think we all need it. And whatever holiday you are celebrating (or not celebrating), I hope you can find your own time to rest and recover. Anyways, let’s go ahead and get into this week’s Security Wrap-Up - SolarWinds releases more details in a new report In an 8-K filing to the US Securities and Exchange commission, SolarWinds has given more details on its recent security troubles. The notice says that FireEye notified the network management biz’s CEO of a serious security issue on December 12th. But by then, the SUNBURST malware had already spread to 18,000 customers. A new report released last Friday show that hackers conducted a dry run in October of 2019. These October files, distributed to customers on October 10th, did not have a backdoor embedded in them and went undetected until this month. By conducting a dry run, hackers were able to determine if an intrusion would be detec

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (December 15th, 2020)

Welcome to another week of security news! There were plenty of security updates and vulnerabilities to discuss, but here are some of the top stories on my feed - Payment processing giant TSYS suffers ransomware attack After the ransomware attack on TSYS, the third-largest third-party payment processor for financial institutions in North America, reams of data have been stolen from the company and posted online, with the attackers promising to publish more in the coming days. But the company says the malware did not jeopardize card data, and that the incident was limited to administrative areas of its business. On December 8th, the cyber criminal gang responsible for deploying the Conti ransomware strain published more than 10 gigabytes of data that it claimed to have removed from TSYS’ networks. Microsoft Office 365 credentials under attack by fax “alert” emails Researchers are warning of a coordinated phishing attack that targeted “numerous” enterprise organizations last week. The

1
M
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (December 8th, 2020)

Welcome back to another edition of our Security Wrap-Up! We have plenty to discuss this week - Patched VMware bug under active attack The National Security Agency (NSA) has escalated concerns regarding the now-patched VMware Workspace One Access and VMware Identity Manager bugs, warning about a greater number of adversaries attempting to leverage the vulnerability to launch attacks to pilfer protected data and abuse shared authentication systems. VMware originally disclosed the vulnerability in late November, identifying it as an escalation-of-privileges flaw that impacts Workspace One Access and other platforms, for both Windows and Linux operating systems. (If you want more info, these are being tracked as CVE-2020-4006.) Amnesia:33 vulnerabilities impact millions of smart and industrial devices Security researchers disclosed 33 security flaws (called Amnesia:33) in four open-source TCP/IP libraries currently used inside the firmware of products from more than 150 vendors. Resear

1
Nic-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (December 1st, 2020)

Happy first day of December, everyone! I think Austin finally got the memo and it got down to 25F last night. I’m currently writing this wrapped up in a sweater and coming to terms with the fact that I will probably need to turn the heater on soon. But, enough about me, let’s turn to this week’s security news - Vulnerabilities in OpenClinic could expose personal health information Four vulnerabilities were recently discovered in the OpenClinic application, one of which would allow a remote, unauthenticated attacker to read patients’ personal health information (PHI) from the application. OpenClinic is an open-source health records management software. Its latest version is 0.8.2, released in 2016, so the flaws remain unpatched. The four bugs involve missing authentication, insecure file upload, cross-site scripting (XSS), and path-traversal. The most high-severity bug (CVE-2020-28937) stems from a missing authentication check on requests for medical test information. Another bug (CVE-2

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (November 24th, 2020)

Happy Thanksgiving edition of the Security Wrap-Up! Well, Happy Thanksgiving to all of my US counterparts. Unfortunately, none of these articles have anything to do with dressing, turkey, or green bean casserole, but they’re good reads to get you through the day. And one day closer to stuffing your face! VMware Zero-Day bug allows command injection Tracked as CVE-2020-4006, this bug impacts both Windows and Linux operating systems and VMware’s Workspace One. The bug has a CVSS severity rating of 9.1 out of 10. “A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system,” VMware wrote. At this point, patches are forthcoming and workarounds for a temporary solution are available. These workarounds are outlined by VMware as a “temporary solution only, and customers are advised to follow VMSA-2020-0027 to be alerted when pat

0
Brittany-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

Security Wrap-Up (November 17th, 2020)

Happy Tuesday, all - hope you had a great weekend! We’re back with some security highlights, so let’s get right into it - Patch Tuesday, November 2020 As always, Krebs on Security has put together a breakdown of highlights from this month’s Patch Tuesday. Adobe and Microsoft both released a number of updates on November 10th to plug critical security holes, with Microsoft including fixes for 112 separate flaws, including one zero-day vulnerability already being exploited to attack Windows users. 17 of the 112 issues involve “critical” problems, with most of the rest assigned the rating “important.” Adobe’s release included updates to plug at least 14 security holes in Adobe Acrobat and Reader. Cisco patches critical flaw after PoC exploit code release Within Cisco Security Manager, enterprise administrators have the ability to enforce various security policies, troubleshoot security events, and manage a wide range of devices. With a new vulnerability (CVE-2020-27130), remote, unauthent

0
Brittany-Automox
3 years ago
CamilleS-Automox
CamilleS-AutomoxFormer Automox Employee
posted in Patch Tuesday

Automox Experts Weigh In On November's Patch Tuesday Release

See what our Automox experts have to say about the latest Patch Tuesday release: https://blog.automox.com/automox-experts-weigh-in-november-patch-tuesday-release. Jay Goodman will be presenting on this topic shortly in our upcoming webinar: https://patch.automox.com/november-2020-patch-tuesday. Happy Patching!

0
CamilleS-Automox
3 years ago
Brittany-Automox
Brittany-AutomoxAutomox Employee
posted in Patch Tuesday

New Series - Security Wrap-Up (November 10th, 2020)

Happy Tuesday, all! I’m happy to announce the introduction of a new series called “Security Wrap-Up,” where we’ll be wrapping up (hence, the name) some of the most important security updates through the past week along with some cybersecurity tips and tricks along the way. Note: This is the first pass at our Security Wrap-Up series, so if you have any suggestions, comments, or concerns, feel free to send them my way and I’d really appreciate it. Any feedback is welcome! Now, to the news - No fix yet for Cisco’s Zero-Day AnyConnect vulnerability The high-severity bug, CVE-2020-3556, earned a CVSS score of 7.3 and is currently undergoing analysis. Due to a lack of authentication to the IPC listener, attackers can exploit this vulnerability by sending crafted IPC messages to the AnyConnect client IPC listener. A successful exploit could allow an attacker to cause the targeted AnyConnect user to execute a script, with all of the privileges of the targeted user. As of yet, Cisco has not rel

0
Brittany-Automox
3 years ago
TaylorT-Automox
TaylorT-AutomoxAutomox Employee
posted in Patch Tuesday

One-Stop-Shop for Patch Tuesday Vulnerabilities - Patch Index

October’s Patch Index is full of Adobe, Chrome, and Microsoft releases. Check it out for an easy way to see which CVEs relate to your environment, and which ones you may want to patch immediately. This month was light in comparison to recent months, but there’s never a time to let your guard down. Also, we just switched blog platforms so let me know if you have formatting suggestions for this monthly piece! Thanks and stay patched. blog.automox.com October 2020 Patch Tuesday Index Don't miss a single vulnerability this Patch Tuesday. The latest patches and updates from Microsoft and multiple third-party applications can be found in October's Patch Tuesday Index.

0
TaylorT-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Patch Tuesday

Security lapse exposes hundreds of addresses of Minnesotans infected with COVID-19

The thing we all feared has come to pass - all that data that’s being collected to help with the pandemic isn’t getting properly secured: KSTP Security lapse exposes hundreds of addresses of Minnesotans infected with... In the letter it stated, "Instead of the City of Minneapolis receiving only addresses in Minneapolis, it has been receiving addresses for what appears to be entire state since Aug. 18, 2020." ...

0
Nic-Automox
3 years ago
Nic-Automox
Nic-AutomoxFormer Automox Employee
posted in Patch Tuesday

Woman dies during a ransomware attack on a German hospital

The Verge – 17 Sep 20 Woman dies during a ransomware attack on a German hospital Experts have been warning for years that this would happen from reddit Looks like the cause of death was indirect. The ransomware shut down the ER of the hospital, so she had to be diverted to another hospital and died en route.

0
Nic-Automox
3 years ago
Terms & ConditionsCookie settings