Volume 21 – Number 18

Internet Storm Center Spotlight

SELECTED BY THE TALOS SECURITY INTELLIGENCE AND RESEARCH GROUP

Title: Microsoft fixes wormable remote code execution vulnerability in HTTP protocol stack

Description: Microsoft released its monthly security update Tuesday, disclosing 55 vulnerabilities across its suite of products, the fewest in any month since January 2020. There are only three critical vulnerabilities patched in this month, while two are of “moderate” severity and the rest are “important.” All three critical vulnerabilities, however, are considered "more likely” to be exploited, according to Microsoft. This month’s security update provides patches for several major pieces of software, including Microsoft Office, SharePoint and Windows’ wireless networking. The most serious vulnerability exists in the HTTP protocol stack. An unauthenticated attacker could exploit CVE-2021-31166 by sending a specially crafted packet to a targeted server utilizing the stack. If successful, the adversary could gain the ability to execute remote code on the targeted server. According to Microsoft, the vulnerability is wormable and the company “recommends prioritizing the patching of affected servers.” It has a CVSS severity score of 9.8 out of 10.

Reference: https://blog.talosintelligence.com/2021/05/microsoft-patch-tuesday-for-may-2021.html

Snort SIDs: 57539, 57540, 57542 – 57545, 57548 - 57550

Title: Cisco discloses critical vulnerabilities that expose corporate networks

Description: Cisco recently patched three critical security vulnerabilities between the SD-WAN vManage software and the HyperFlex HX platform. These vulnerabilities, if left unpatched, could allow an attacker to completely take over corporate networks that are using this software. vManage is a network management system that allows users to monitor and configure any devices and links they have in the broader SD-WAN. The most serious vulnerability in this group is CVE-2021-1468, which has a CVSS severity score of 9.8 out of 10. An attacker could exploit this vulnerability by submitting a specially crafted input to the service, eventually allowing them to call privileged actions on the affected systems. The adversary could then also create new administrative-level accounts.

Reference: https://threatpost.com/critical-cisco-sd-wan-hyperflex-bugs/165923/

Snort SIDs: 57527 – 57530, 57535 - 57538

Internet Storm Center Entries

On Friday, Colonial Pipeline shut down 5,500 miles of fuel pipeline after its systems were hit with a ransomware attack.

https://www.nytimes.com/2021/05/08/us/politics/cyberattack-colonial-pipeline.html

The FBI has confirmed that the Russian-linked threat group Darkside is responsible for the Colonial Pipeline attack.

https://www.cnet.com/news/fbi-says-darkside-hacking-group-responsible-for-pipeline-cyberattack/

The Department of Transportation's Federal Motor Carrier Safety Administration issued a regional emergency declaration to provide emergency transportation for fuel.

https://www.axios.com/fuel-pipeline-cyberattack-us-state-of-emergency-dda2e776-f0f0-45cc-ae38-4fea47e014ec.html

Just 4 percent of iPhone users have reportedly opted into app tracking after new security settings rolled out in the latest iOS update.

https://www.engadget.com/ios-14-5-users-reject-app-tracking-165309407.html

A joint advisory from the FBI, NSA, CISA, and the UK’s National Cyber Security Centre “provides further details of Tactics, Techniques and Procedures (TTPs) associated with SVR cyber actors. SVR cyber actors are known and tracked in open source as APT29, Cozy Bear, and the Dukes."

https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf

New details released as part of an ongoing lawsuit between video game maker Epic and Apple disclosed that 128 million iPhone users have downloaded malicious apps containing malware known as XCodeGhost.

https://www.vice.com/en/article/n7bbmz/the-fortnite-trial-is-exposing-details-about-the-biggest-iphone-hack-of-all-time

A recently discovered vulnerability in Qualcomm chips affects nearly 30 percent of all mobile phones and could allow an attacker to snoop on users’ phone calls and text messages.

https://gizmodo.com/qualcomm-chip-flaw-could-leave-30-percent-of-the-worlds-1846837667

A security researcher successfully jailbroke one of the new Apple AirTags, raising potential questions about the devices’ security.

https://arstechnica.com/information-technology/2021/05/security-researcher-successfully-jailbreaks-an-apple-airtag/

Recent CVEs

COMPILED BY THE QUALYS VULNERABILITY RESEARCH TEAM

This is a list of recent vulnerabilities for which exploits are available. System administrators can use this list to help in prioritization of their remediation activities. The Qualys Vulnerability Research Team compiles this information based on various exploit frameworks, exploit databases, exploit kits and monitoring of internet activity.

ID: CVE-2020-17510

Title: Authentication Bypass Vulnerability in Apache Shiro

Vendor: Apache

Description: Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.