Guidance on Memory Safety Bugs in Open Source Software; Critical MOVEit Vulnerability

In December 2023, government agencies from the Five Eyes countries (Australia, Canada, New Zealand, the UK, and the US) published joint guidance offering steps for developing roadmaps to eliminating memory safety vulnerabilities. A new jointly published document from the US Cybersecurity and Infrastructure Security Agency (CISA), the FBI, Australia's Cyber Security Center (ACSC), and the Canadian Centre for Cybersecurity (CCCS) provides a starting point for these roadmaps by investigating the scale of memory safety risk in selected open-source software (OSS). According to the report, more than half of the 172 listed Open Source Security Foundation projects include code written in languages that are not memory-safe.

A critical improper authentication vulnerability in the MOVEit file transfer tool that can be exploited to bypass authentication measures is being actively exploited. Users are urged to update to the latest patched version of the tool as soon as possible. Progress Software has also identified a vulnerability in a third-party component of MOVEit Transfer and has made recommendations for mitigating that issue.

Researchers from Claroty's Team82 discovered several vulnerabilities in an Emerson Rosemount 370XA gas chromatograph. These devices are often connected to a network so technicians can operate them remotely, in this case using a proprietary Emerson protocol. Team82 conducted their research on an emulated device. They found four vulnerabilities, all of which were confirmed by Emerson. CISA released an advisory in January, and the vendor notified customers at that time of available firmware updates, noting that 'if the affected product is isolated from the internet as recommended and running on a well-protected network consistent with industry best practices, the potential risk is lowered.'

CDK Global, the software-as-a-service (SaaS) provider for 15,000 US automobile dealerships now says that an outage due to a ransomware attack is likely to last at least through the end of June. The attack hit CDK last Tuesday (June 18). While the company was attempting to get its systems back online the following day, they experienced a second attack. Recently, news outlets have been reporting that CDK plans to pay the ransom demand.

Siemens has released updates to address several vulnerabilities affecting their Sicam products. Two of the vulnerabilities are rated high-severity: a buffer overread issue that could be exploited to achieve code execution or denial-of-service conditions, and a privilege elevation issue that could allow execution of arbitrary code with root privileges.

GitLab has released updates for GitLab Community Edition (CE) and Enterprise Edition (EE) to address 14 security issues, including a critical improper access control vulnerability (CVE-2024-5655) that could be exploited 'to trigger a pipeline as another user under certain circumstances.' The updates also include fixes for three high-severity vulnerabilities. Users are urged to update to GitLab CE/EE versions 17.1.1, 17.0.3, and 16.11.5 as soon as possible.

According to a report from the US Government Accountability Office (GAO), the Department of Defense's (DOD) Defense Counterintelligence and Security Agency (DCSA) conducts background investigations using both recently developed DOD National Background Investigation Services systems and legacy systems formerly owned by the Office of Personnel Management (OPM).Ó Among the GAOÕs findings: DCSA chose controls for the systems they use, but did not follow current guidance; privacy controls for certain background investigation systems were not fully implemented; and DCSA did not ensure that users had current training and certifications.

LockBit ransomware operators recently threatened to release data they said was taken from the US Federal Reserve Bank. Some of the data were posted to the LockBit website on June 26; examination of the information indicates that it was likely taken from Arkansas-based Evolve Bank & Trust. Evolve has confirmed the breach and leak of their data. The US Federal Reserve Board recently issued an enforcement action against Evolve Bancorp and Evolve Bank & Trust for 'engag[ing] in unsafe and unsound banking practices by failing to have in place an effective risk management framework for those partnerships.'

Authorities in Crimea are warning that distributed denial-of-service (DDoS) attacks targeting the area's telecommunications organizations. The 'massive' attacks, which began on Wednesday, June 26, have disrupted Internet connectivity. One of the targeted telecoms provides services to Sevastopol's emergency call center. Officials say that call center services were disrupted, but have been restored as of Thursday, June 27. Sevastopol is Crimea's largest city.