perm_phone_msgUNDER ATTACK? S.O.S. LINE 0114 354 0054

Top Categories

Spotlight

today11/06/2021

Cyber security TechRepublic

McDonald’s suffers cyberattack in US, South Korea and Taiwan

The restaurant chain reportedly said no U.S. customer data was exposed and the attack did not involve ransomware. Image: seksan Mongkhonkhamsao/Moment/Getty Images McDonald’s is the latest company to fall victim to a cyberattack exposing customer and other data in the U.S., Taiwan and China, The Wall Street Journal has reported. [...]

Top Voted
Sorry, there is nothing for the moment.

Citrix tells everyone not to worry too much about its latest security patches. NSA’s former top hacker disagrees

Cyber security The Register today08/07/2020 33

Background
share close

Citrix has issued patches for 11 CVE-listed security vulnerabilities in its various networking products.

The bundle includes fixes for one code injection bug, three information disclosure flaws, three elevation of privilege bugs, two cross-site scripting vulnerabilities, one denial-of-service hole, and one authorization-bypass flaw.

Affected gear includes the Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP. So far there have been no reports of any of the bugs being targeted in the wild, though Rob Joyce, former head of the NSA’s Tailored Access Operations elite hacking team, urged admins to apply the patches – right after fixes emerged for vulns in F5 and Palo Alto networking gear, too.

The code injection flaw, CVE-2020-8194, is interesting. According to Citrix, an unauthenticated remote attacker can somehow present to a potential victim a downloadable malicious executable file from the gateway’s IP address. If the mark fetches the file and runs it, thinking it’s a legit application file from their networking gear, they now have malicious code running on their local PC. No other details on this cryptic flaw are known right now.

Meanwhile, those who rely on Linux PCs will want to check out CVE-2020-8199, a flaw in the Citrix Gateway Plugin for Linux that can be exploited by a rogue user or malware already on the system to elevate its privileges and cause more damage.

On the more likely-to-be-targeted end of things, there is CVE-2020-8187. That is a denial-of-service flaw in Citrix ADC and Citrix Gateway 12.0 or 11.1. The flaw can be remotely exploited without authentication.

Administrators will also want to pay close attention to CVE-2020-8198. That cross site scripting bug can be exploited externally without authentication, but requires the target to be logged into the vulnerable device as an admin. This, in other words, would be useful for a targeted attack against the folks that control all the systems.

Australian prime minister scott morrison

Australian PM says nation under serious state-run ‘cyber attack’ – Microsoft, Citrix, Telerik UI bugs ‘exploited’

READ MORE

Another cross-site-scripting flaw, CVE-2020-8191, only requires the victim to open a link while on the same network as a vulnerable gateway, so that one could be a wider issue.

The other bugs mainly require the attacker to already be logged into the device. They include CVE-2020-8195 and CVE-2020-8196 (information disclosure) and CVE-2020-8197. While not as hair-raising as bugs that are remotely exploitable without authentication, an attacker who had simply gained a foothold on one device could use these flaws to get further control and access, so they are definitely worth patching sooner rather than later.

Looking to avoid a repeat of the Christmas security crisis, when a remote code execution bug was disclosed in ADC and Gateway, Citrix made a point of trying to calm the nerves of admins by bringing out CISO Fermin Serna to explain that none of the bugs are as serious, or as easily exploited, as the infamous CVE-2019-19781 “Shitrix” vulnerability in December.

“There are barriers to many of these attacks; in particular, for customers where there is no untrustworthy traffic on the management network, the remaining risk reduces to a denial-of-service attack. And in that case, only when Gateway or authentication virtual servers are being used,” noted Serna.

“Other virtual servers, for example, load balancing and content switching virtual servers, are not affected by the issue.”

Others, with a lot of experience, may disagree. ®

See the original article here: The Register

Written by: The Register

Rate it
Previous post

today08/07/2020

  • 9
close

Cyber security ITPro.

What is a DDoS attack?

Distributed denial of service (DDoS) attacks are widely-considered to be the sledgehammer of cyber attacks. Rather than attempt to quietly infiltrate targeted software and computers, DDoS attacks effectively use brute force ...