Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing outside attack surface. Netizen’s Security Operations Center (SOC) has compiled five vulnerabilities from January that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2023-23314:
Zdir v3.2.0 allows attackers to execute arbitrary code. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. The Zdir gives access to the file system index. An upload vulnerability within the api/upload component of the Zdir version 3.2.0 allows an attacker to establish an RCE (Remote Code Execution) through a .ssh file. This vulnerability requires no user interaction and has a high impact on the CIA Triad.
CVE-2016-1018:
Adobe Flash Player Stack-based buffer overflow. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability affects Adobe Flash Player in versions before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux. User interaction is required in order to perform the attack. The vulnerability is in how the JPEG-XR file is handled. There is a failure in how the index is checked within the bounds of a buffer, thus causing a possible buffer overflow. This vulnerability can lead to an attacker leveraging a system through the execution of arbitrary code.
CVE-2022-34324:
Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability affects an unknown part of the add Currencies, Payment Order, and Transfer History component of the Sage XRT Business Exchange version 12.4.302. The vulnerability doesn’t require user interaction but does require an attacker to be authenticated in order to inject the malicious data in SQL queries.
CVE-2020-9910:
Multiple issues were addressed with improved logic in Apple’s Safari Web Browser. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and affects iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Although this vulnerability has been fixed, it could possibly allow a malicious attacker with arbitrary read & write abilities to bypass Pointer Authentication. Successful exploitation could allow RCE. The attack complexity is low and can have a high impact on the CIA Triad.
CVE-2021-22048:
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability is within the IWA of vCenter Server and allows for a non-admin authenticated attacker to elevate privileges to a higher privileged group and poses a high risk to the CIA Triad.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Questions or concerns? Feel free to reach out to us any time – https://www.netizen.net/contact
