Weekly threat roundup: Chrome, Citrix and WordPress

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Google Chrome Zero-day under active exploitation  

The latest stable channel update for the desktop installation of the Chrome web browser has seen Google fix several high-risk vulnerabilities and one medium-risk vulnerability, numbering five in total

The highlight of the five patches includes the heap buffer overflow in FreetType flaw, tagged CVE-2020-15999 and rated ‘high’, which is a zero-day flaw which attackers are actively exploiting. FreeType is a widely used software development library that’s also a Chrome component, and the bug in this font rendering library affects the browser on Windows, macOS as well as Linux.

Privilege escalation flaws in Citrix VPN

The Citrix Gateway Plug-In for Windows, a widely used business-oriented virtual private network (VPN), is embedded with multiple escalation of privilege flaws, according to cyber security researchers from Cymptom

Tagged as CVE-2020-8257 and CVE-2020-8258, these two vulnerabilities lie in the way the Citrix Gateway Service runs as SYSTEM, and executes a periodic PowerShell script every five minutes, also executed as SYSTEM. As powershell.exe is invoked in file name only, Windows searches through multiple directories to find it. Hackers could exploit this by creating a malicious file, naming it powershell.exe, and copying it into every directory they have access to, which would allow them to achieve elevation of privileges on systems running Citrix Gateway Plug-In for Windows.

VMware software breaking Cisco HyperFlex clusters

This week Cisco warned HyperFlex users that a VMware coding bug in vCenter Server 7.0 U1may leave their hyperconverged infrastructure installations in an ‘unrecoverable’ state.

The bug, which affects HyperFlex controllers managed by the vCenter ESX Agent Manager (EAM) service, causes affected HyperFlex clusters to encounter an issue where HyperFlex controller VMs suddenly power off and are deleted. This results in the loss of cluster availability, and sometimes can even render the HyperFlex storage cluster “unrecoverable”. 

There are no workarounds available at this time, with cisco recommending that customers do not use vCenter 7.0 GA or vCenter 7.0 U1 until they are qualified and listed as a supported combination in the HyperFlex Data Platform release notes. 

KashmirBlack botnet hitting CMS platforms

The existence of one of the most sophisticated active botnets was disclosed this week, with researchers detailing how KashmirBlack, as it’s called, has compromised hundreds of thousands of systems to attack content management systems (CMS).

Spread across 30 countries, and conducting millions of attacks each day, this botnet exploits a decade-old PHPUnite remote code execution flaw to attack CMS platforms, mainly due to their generally poor cyber hygiene. 

This particular flaw is known and patchable, but the botnet has capitalised on the surge in the companies disrupted by coronavirus, which now require easy-to-use web frameworks to move their business online. This includes well-known platforms like WordPress.

Address spoofing bug hits widely-used mobile browsers

Several popular mobile web browsers, including Safari and Opera Touch, are susceptible to exploitation due to a web address spoofing bug that could allow hackers to perform spear-phishing attacks, or deploy malware.

The vulnerability could allow an attacker to set up a malicious website and tempt a victim into opening a link from a spoofed email or text message. This would then lead the user to a malicious site disguised as a legitimate site, on which they could download a malicious file, or hand over personal information.

The origin lies in the way a hacker could execute malicious JavaScript code on this website to force the browser to update the address bar to another address of the attacker’s preference, all while the page loads.

Emergency WordPress patch for SQL injection attack

The Loginizer security plugin for WordPress, which has more than a million active installations, was forcibly patched by the CMS platform this week after WP Deeply researchers disclosed a dangerous vulnerability.

The plugin, which protects sites from brute force attacks, was afflicted with an SQL injection bug that could have allowed hackers to seize control of users’ WordPress sites. This severe vulnerability lies in the plug-in’s core brute force protection mechanism, and can be exploited by a hacker who logs into a WordPress site using a malformed username, in which they include SQL statements. 

Upon failed authentication, Loginizer will record this failed attempt in the site’s database, along with the failed username, however, the plugin doesn’t wipe the username and leaves the SQL statements intact. This opens the door for attackers to run code against the database remotely, and compromise the site.

Ryuk ransomware strikes again - targeting French IT giant

Hackers linked with the Ryuk ransomware group have attacked the IT services firm Sopra Steria, although the French company has revealed few little details around the nature or scale of the cyber attack.

The company runs a joint venture with the UK’s Department of Health and Social Care to offer services such as accounting, payroll and managed IT to NHS organisations. It’s unclear whether any of these services have been disrupted as a result of the attack, although French media have claimed the Ryuk malware strain is to blame. Other organisations are being warned to stay alert with regards to the ongoing disruptive threat that ransomware poses.

Featured Resources

Next-generation time series: Forecasting for the real world, not the ideal world

Solve time series problems with AI

Free download

The future of productivity

Driving your business forward with Microsoft Office 365

Free download

How to plan for endpoint security against ever-evolving cyber threats

Safeguard your devices, data, and reputation

Free download

A quantitative comparison of UPS monitoring and servicing approaches across edge environments

Effective UPS fleet management

Free download

Recommended

Microsoft touts new cyber security help for nonprofits
cyber security

Microsoft touts new cyber security help for nonprofits

22 Oct 2021
Ofcom report reveals alarming uptick in smishing attacks
scams

Ofcom report reveals alarming uptick in smishing attacks

22 Oct 2021
Graylog launches new cyber security solution to address legacy issues
cyber security

Graylog launches new cyber security solution to address legacy issues

21 Oct 2021
US to ban surveillance software exports to authoritarian governments
cyber security

US to ban surveillance software exports to authoritarian governments

21 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021