Cyber Security Alerts & Threat Intelligence

Original release date: November 19, 2020<br/><p>Google has released Chrome version 87.0.4280.66 for Windows, Mac, and Linux to address multiple vulnerabilities. Some of these vulnerabilities could allow an attacker to take control of an affected system.</p> <p>The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the <a href=”https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html”>Chrome Release</a> and apply the necessary updates.</p> <div class=”field field–name-body field–type-text-with-summary field–label-hidden field–item”><p class=”privacy-and-terms”>This product is provided subject to this <a href=”https://us-cert.cisa.gov/privacy/notification”>Notification</a> and this <a href=”https://www.dhs.gov/privacy-policy”>Privacy &amp; Use</a> policy.</p> </div>

Original release date: November 19, 2020<br/><p>Drupal has released security updates to address a critical vulnerability in Drupal 7, 8.8 and earlier, 8.9, and 9.0. An attacker could exploit this vulnerability to take control of an affected system.</p> <p>The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the Drupal Advisory <a href=”https://www.drupal.org/sa-core-2020-012″>SA-CORE-2020-012</a>, apply the necessary updates, and follow the additional recommendation.</p> <div class=”field field–name-body field–type-text-with-summary field–label-hidden field–item”><p class=”privacy-and-terms”>This product is provided subject to this <a href=”https://us-cert.cisa.gov/privacy/notification”>Notification</a> and this <a href=”https://www.dhs.gov/privacy-policy”>Privacy &amp; Use</a> policy.</p> </div>

Original release date: November 19, 2020<br/><p>Cisco has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.</p> <p>The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following Cisco Security Advisories and apply the necessary updates.</p> <ul> <li>Integrated Management Controller Multiple Remote Code Execution Vulnerabilities <a href=”https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ucs-api-rce-UXwpeDHd”>cisco-sa-ucs-api-rce-UXwpeDHd</a></li> <li>DNA Spaces Connector Command Injection Vulnerability <a href=”https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-dna-cmd-injection-rrAYzOwc”>cisco-sa-dna-cmd-injection-rrAYzOwc</a></li> <li>IoT Field Network Director Unauthenticated REST API Vulnerability <a href=”https://us-cert.cisa.gov https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-FND-BCK-GHkPNZ5F”>cisco-sa-FND-BCK-GHkPNZ5F</a></li> <li>Secure Web Appliance Privilege Escalation Vulnerability <a href=”https://us-cert.cisa.gov https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wsa-prv-esc-nPzWZrQj”>cisco-sa-wsa-prv-esc-nPzWZrQj</a></li> <li>IoT Field Network Director SOAP API…

Original release date: November 16, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info bbraun — onlinesuite_application_package A relative path traversal attack in the B. Braun OnlineSuite Version AP 3.0 and earlier allows unauthenticated attackers to upload or download arbitrary files. 2020-11-06 7.5 CVE-2020-25172 MISC google — android In…

Original release date: November 9, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info adobe — acrobat Adobe Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to…

Original release date: November 2, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info apple — airport_base_station_firmware An out-of-bounds read was addressed with improved input validation. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base Station Firmware Update 7.9.1. A remote attacker may be able…

Original release date: October 30, 2020 | Last revised: November 3, 2020<br/><h3>Summary</h3><p class=”tip-intro” style=”font-size: 15px;”><em>This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) version 8 framework. See the <a href=”https://attack.mitre.org/versions/v8/techniques/enterprise/”>ATT&amp;CK for Enterprise version 8</a> for all referenced threat actor techniques.</em></p> <p>This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). CISA and the FBI are aware of an Iranian advanced persistent threat (APT) actor targeting U.S. state websites—to include election websites. CISA and the FBI assess this actor is responsible for&nbsp;the mass dissemination of voter intimidation…

Original release date: October 28, 2020 | Last revised: November 2, 2020<br/><h3>Summary</h3><p><strong><em>This advisory was updated to include information on Conti, TrickBot, and BazarLoader, including new IOCs and Yara Rules for detection.</em></strong></p> <p class=”tip-intro” style=”font-size: 15px;”><em>This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) version 7 framework. See the <a href=”https://attack.mitre.org/versions/v7/techniques/enterprise/”>ATT&amp;CK for Enterprise version 7</a> for all referenced threat actor tactics and techniques.</em></p> <p>This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Health and Human Services (HHS). This advisory describes the tactics, techniques,…

Original release date: October 27, 2020<br/><h3>Summary</h3><p class=”tip-intro” style=”font-size: 15px;”><em>This advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) version 7 framework. See the <a href=”https://attack.mitre.org/versions/v7/techniques/enterprise/”>ATT&amp;CK for Enterprise version 7</a> for all referenced threat actor tactics and techniques.</em></p> <p>This joint cybersecurity advisory was coauthored by the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the U.S. Cyber Command Cyber National Mission Force (CNMF). This advisory describes the tactics, techniques, and procedures (TTPs) used by North Korean advanced persistent threat (APT) group <a href=”https://attack.mitre.org/groups/G0094/”>Kimsuky</a>—against worldwide targets—to gain intelligence on various topics of interest to the…

Original release date: October 26, 2020 The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.   High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source & Patch Info acronis — cyber_backup Acronis Cyber Backup 12.5 and Cyber Protect 15 include an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:jenkins_agent. Acronis Cyber Backup and Cyber Protect contain a privileged service…

Original release date: October 22, 2020<br/><h3>Summary</h3><p>The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) are warning that Iranian advanced persistent threat (APT) actors are likely intent on influencing and interfering with the U.S. elections to sow discord among voters and undermine public confidence in the U.S. electoral process.</p> <p>The APT actors are creating fictitious media sites and spoofing legitimate media sites to spread obtained U.S. voter-registration data, anti-American propaganda, and misinformation about voter suppression, voter fraud, and ballot fraud.</p> <p>The APT actors have historically exploited critical vulnerabilities to conduct distributed denial-of-service (DDoS) attacks, structured query…

Original release date: October 22, 2020 | Last revised: November 17, 2020<br/><h3>Summary</h3><p class=”tip-intro” style=”font-size: 15px;”><em>This joint cybersecurity advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&amp;CK®) framework. See the <a href=”https://attack.mitre.org/versions/v7/”>ATT&amp;CK for Enterprise</a> framework for all referenced threat actor tactics and techniques </em></p> <p>This joint cybersecurity advisory—written by the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA)—provides information on Russian state-sponsored advanced persistent threat (APT) actor activity targeting various U.S. state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks. This advisory updates joint CISA-FBI cybersecurity advisory <a href=”https://us-cert.cisa.gov/ncas/alerts/aa20-283a”>AA20-283A: APT…