Zero-Day Flaw in Apache OFBiz ERP Allows Remote Code Execution vulnerability

Severity: Zero day

Date of Publish: 06,Aug'24

Affected System:

Apache OFBiz: through 18.12.14

Summary

Apache OFBiz open-source enterprise resource planning ERP Allows Remote Code Execution vulnerability

Description

a zero-day pre-authentication remote code execution vulnerability was  identified  in the Apache OFBiz open-source enterprise resource planning (ERP) system that could allow remote attacker to execute arbitrary code in the affected systems..

Recommendations /Solutions

upgrade to version 18.12.15

 

Vendor Reference:

https://issues.apache.org/jira/browse/OFBIZ-13128
https://lists.apache.org/thread/olxxjk6b13sl3wh9cmp0k2dscvp24l7w
https://ofbiz.apache.org/download.html
https://ofbiz.apache.org/security.html

 

CVE:

CVE-2024-38856

NOTE : The information is provide is on “as is “ basis, without assurance of any kind .

 Revision history

1. 06-Aug-24 - First advisory released. ---update -update version avaible

 

Read More

Windows Crashes Due to Crowdstrike Updates

Windows Crashes Due to Crowdstrike Updates

Date of Publish : July 20,2024

Severity-Critical

System Affected

• Windows hosts

Non Affected systems

• MacOS
• Linux system

Summary

Crowdstrike released an update that is causing widespread "blue screens of death" (BSOD) on Windows systems.

Description,

This situation occur may be by sending a phishing emails circulating claiming come from "Crowdstrike Support" or "Crowdstrike Security" to update the component. One domain possibly associated with these phishing attacks is : crowdfalcon-immed-update [ .] com .once copned and download it will cause BSOD attack.

Workaround steps for individual hosts:

• Reboot the host to give it an opportunity to download the reverted channel file. We strongly recommend putting the host on a wired network (as opposed to WiFi) prior to rebooting as the host will acquire internet connectivity considerably faster via ethernet.
• If the host crashes again, then:
• Boot Windows into Safe Mode or the Windows Recovery Environment
• NOTE: Putting the host on a wired network (as opposed to WiFi) and using Safe Mode with Networking can help remediation.
• Navigate to the %WINDIR%\System32\drivers\CrowdStrike directory
• Windows Recovery defaults to X:\windows\system32
• Navigate to the appropriate partition first (default is C:\), and navigate to the crowdstrike directory:
• C:
• cd windows\system32\drivers\crowdstrike
• Note: On WinRE/WinPE, navigate to the Windows\System32\drivers\CrowdStrike directory of the OS volume
• Locate the file matching “C-00000291*.sys” and delete it.
• Do not delete or change any other files or folders
• Cold Boot the host
• Shutdown the host.
• Start host from the off state.

Note: BitLocker-encrypted hosts may require a recovery key

References.

Vendor Reference.

https://www.crowdstrike.com/blog/statement-on-windows-sensor-update/.

NOTE : The information is provide is on “as is “ basis, without assurance of any kind .

Revision history

1. 19-Jun-24 - First advisory released. ---update -workaround available 

Read More

Sysinternals' Process Monitor v4 Released

Sysinternals' Process Monitor v4 Released

Date of Publish: June 26,2024

New version of process  monitor is released and  improves performance and user interface.

Process Monitor:https://learn.microsoft.com/sysinternals/downloads/procmon

 

NOTE : The information is provide is on “as is “ basis, without assurance of any kind 

 

Read More

Multiple vulnerbilities in Redhat Enterprise Linux

Date:June 21,2024

Severity:Medium

Impacted system

• Red Hat Enterprise Linux for x86_64
• Red Hat Enterprise Linux for ARM 64
• Red Hat Enterprise Linux for Power, little endian
• Red Hat Enterprise Linux for IBM z Systems
• Red Hat Enterprise Linux Fast Datapath (for IBM z Systems)
• Red Hat Enterprise Linux Fast Datapath (for RHEL Server for IBM Power LE)
• Red Hat Enterprise Linux Fast Datapath
• Red Hat Enterprise Linux Fast Datapath (for RHEL for ARM 64)
• Red Hat Service Interconnect
• Red Hat OpenShift Serverless for IBM Z and LinuxONE
• Red Hat Openshift Serverless
• Red Hat Openshift Serverless for ARM
• Red Hat OpenShift Serverless for IBM Power, little endian
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support
• Red Hat Enterprise Linux for x86_64 - Extended Update Support
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
• Red Hat Enterprise Linux Server - TUS
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
• Red Hat Enterprise Linux Server - Extended Life Cycle Support
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian
• Red Hat Enterprise Linux Server
• Red Hat Enterprise Linux Desktop
• Red Hat Enterprise Linux Workstation
• Red Hat Enterprise Linux Server for ARM 64 - 4 years of updates
• Red Hat Enterprise Linux Server for IBM z Systems - 4 years of updates
• Red Hat Enterprise Linux Server - AUS
• Red Hat CodeReady Linux Builder for ARM 64
• Red Hat CodeReady Linux Builder for Power, little endian
• Red Hat CodeReady Linux Builder for x86_64
• Red Hat CodeReady Linux Builder for IBM z Systems
• Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
• Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
• Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
• Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
• Red Hat Migration Toolkit for Applications

Summary

Redhat publish multiple vulnerabilities in their Redhat  enterprise linux and other system by which an attacker could allow remote code execution or take control of the affected system .

Description

RHSA-2024:4004	Important:thunderbird security update
RHSA-2024:4014	Important:ghostscript security update
RHSA-2024:4015	Important:thunderbird security update
RHSA-2024:4016	Important:thunderbird security update
RHSA-2024:4018	Important:thunderbird security update
RHSA-2024:4023	Important:Release of openshift-serverless-clients kn 1.33.0 security update & enhancements
RHSA-2024:4028	Moderate:Release of OpenShift Serverless 1.33.0 security update & enhancements
RHSA-2024:4034	Important:Red Hat Service Interconnect 1.5.4 Release security update (images)
RHSA-2024:4035	Important:ovn-2021 security update
RHSA-2024:4036	Important:thunderbird security update
RHSA-2024:4003	Important:thunderbird security update
RHSA-2024:4002	Important:thunderbird security update
RHSA-2024:4001	Important:thunderbird security update
RHSA-2024:4000	Important:ghostscript security update
RHSA-2024:3999	Important:ghostscript security update
RHSA-2024:3998	Moderate:curl security update
RHSA-2024:3989	Important:Migration Toolkit for Applications security and bug fix update

Solution

Please apply patches/fixes as recommended by vendor :

https://access.redhat.com/security/security-updates/security-advisories?q=&p=1&sort=portal_publication_date+desc&rows=10&portal_advisory_type=Security+Advisory&documentKind=Errata

Vendor Information

Redhat :

https://access.redhat.com/security/security-updates/security-advisories?q=&p=1&sort=portal_publication_date+desc&rows=10&portal_advisory_type=Security+Advisory&documentKind=Errata

NOTE : The information is provide is on “as is “ basis, without assurance of any kind 

Read More

Multiple remote code execution in VMWare products

Multiple remote code execution in VMWare products.

Date of Publish: June 20,24

Severity:Critical

Affected Software:

• VMware vCenter Server
• VMware Cloud Foundation

Summary:

Multiple remote code execution vulnerabilities in VMware products  which can allow attacket to take over the contrl of the affected systems.

Description:

The list of vulnerabilities is as follows -

• CVE-2024-37079 & CVE-2024-37080- Multiple heap-overflow vulnerabilities in the implementation of the DCE/RPC protocol that could allow a,n attacker with network access to vCenter Server can do remote code execution by sending a specially crafted network packet

• CVE-2024-37081 - Multiple local privilege escalation vulnerabilities in VMware vCenter arising due to the misconfiguration of ("sudo") that an authenticated local user with non-administrative privileges could exploit to obtain root permissions.

Impacted CVE:

CVE-2024-37079
CVE-2024-37080
CVE-2024-37081

 Solution:

https://core.vmware.com/resource/vmsa-2024-0012-questions-answers#introduction

 

Vendor reference:

https://core.vmware.com/resource/vmsa-2024-0012-questions-answers#introduction

Broadcom:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453 

 

NOTE : The information is provide is on “as is “ basis, without assurance of any kind 

Read More

Microsoft Patch Tuesday June 2024

 Microsoft Patch Tuesday June 2024

Microsoft has released vulnerabilities for multiple products  

Date :Jun14,2024

Description
CVE	Disclosed	Exploited	Severity	CVSS Base (AVG)	CVSS Temporal (AVG)
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
CVE-2024-35255	No	No	Important	5.5	4.8
Azure Monitor Agent Elevation of Privilege Vulnerability
CVE-2024-35254	No	No	Important	7.1	6.2
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
CVE-2024-37325	No	No	Important	8.1	7.3
Azure Storage Movement Client Library Denial of Service Vulnerability
CVE-2024-35252	No	No	Important	7.5	6.5
Chromium: CVE-2024-5493 Heap buffer overflow in WebRTC
CVE-2024-5493	No	No	-
Chromium: CVE-2024-5494 Use after free in Dawn
CVE-2024-5494	No	No	-
Chromium: CVE-2024-5495 Use after free in Dawn
CVE-2024-5495	No	No	-
Chromium: CVE-2024-5496 Use after free in Media Session
CVE-2024-5496	No	No	-
Chromium: CVE-2024-5497 Out of bounds memory access in Keyboard Inputs
CVE-2024-5497	No	No	-
Chromium: CVE-2024-5498 Use after free in Presentation API
CVE-2024-5498	No	No	-
Chromium: CVE-2024-5499 Out of bounds write in Streams API
CVE-2024-5499	No	No	-
DHCP Server Service Denial of Service Vulnerability
CVE-2024-30070	No	No	Important	7.5	6.7
GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
CVE-2024-29187	No	No	Important	7.3	6.4
MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU
CVE-2023-50868	Yes	No	Important	7.5	6.5
Microsoft Azure File Sync Elevation of Privilege Vulnerability
CVE-2024-35253	No	No	Important	4.4	4.2
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2024-35263	No	No	Important	5.7	5
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
CVE-2024-35248	No	No	Important	7.3	6.4
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
CVE-2024-35249	No	No	Important	8.8	7.7
Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability
CVE-2024-30072	No	No	Important	7.8	6.8
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVE-2024-30080	No	No	Critical	9.8	8.5
Microsoft Office Remote Code Execution Vulnerability
CVE-2024-30101	No	No	Important	7.5	6.5
CVE-2024-30102	No	No	Important	7.3	6.4
CVE-2024-30104	No	No	Important	7.8	6.8
Microsoft Outlook Remote Code Execution Vulnerability
CVE-2024-30103	No	No	Important	8.8	7.7
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-30100	No	No	Important	7.8	6.8
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
CVE-2024-30097	No	No	Important	8.8	7.7
Microsoft Streaming Service Elevation of Privilege Vulnerability
CVE-2024-30089	No	No	Important	7.8	6.8
CVE-2024-30090	No	No	Important	7	6.1
Visual Studio Elevation of Privilege Vulnerability
CVE-2024-29060	No	No	Important	6.7	5.8
Visual Studio Remote Code Execution Vulnerability
CVE-2024-30052	No	No	Important	4.7	4.1
Win32k Elevation of Privilege Vulnerability
CVE-2024-30082	No	No	Important	7.8	6.8
CVE-2024-30087	No	No	Important	7.8	6.8
CVE-2024-30091	No	No	Important	7.8	7
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
CVE-2024-30085	No	No	Important	7.8	7
Windows Container Manager Service Elevation of Privilege Vulnerability
CVE-2024-30076	No	No	Important	6.8	5.9
Windows Cryptographic Services Information Disclosure Vulnerability
CVE-2024-30096	No	No	Important	5.5	4.8
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2024-30063	No	No	Important	6.7	5.8
Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-30064	No	No	Important	8.8	7.7
CVE-2024-30068	No	No	Important	8.8	7.7
CVE-2024-30088	No	No	Important	7	6.3
CVE-2024-30099	No	No	Important	7	6.3
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
CVE-2024-35250	No	No	Important	7.8	6.8
CVE-2024-30084	No	No	Important	7	6.1
Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
CVE-2024-30074	No	No	Important	8	7.2
CVE-2024-30075	No	No	Important	8	7
Windows OLE Remote Code Execution Vulnerability
CVE-2024-30077	No	No	Important	8	7
Windows Perception Service Elevation of Privilege Vulnerability
CVE-2024-35265	No	No	Important	7	6.1
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-30069	No	No	Important	4.7	4.1
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30094	No	No	Important	7.8	6.8
CVE-2024-30095	No	No	Important	7.8	6.8
Windows Standards-Based Storage Management Service Denial of Service Vulnerability
CVE-2024-30083	No	No	Important	7.5	6.5
Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
CVE-2024-30062	No	No	Important	7.8	7
Windows Storage Elevation of Privilege Vulnerability
CVE-2024-30093	No	No	Important	7.3	6.4
Windows Themes Denial of Service Vulnerability
CVE-2024-30065	No	No	Important	5.5	4.8
Windows Wi-Fi Driver Remote Code Execution Vulnerability
CVE-2024-30078	No	No	Important	8.8	7.7
Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-30086	No	No	Important	7.8	6.8
Winlogon Elevation of Privilege Vulnerability
CVE-2024-30066	No	No	Important	5.5	4.8
CVE-2024-30067	No	No	Important	5.5	4.8

 

Original Advisory

Microsoft

https://msrc.microsoft.com/update-guide/vulnerability

NOTE:The Information provided is on "as is" basis, without assurance of any kind.

Read More

Multiple Vulnerabilities in Google ChromeOS

Multiple Vulnerabilities in Google ChromeOS

Publish Date : June 12, 24

Severity Rating: HIGH
 
Affected version:
• LTS channel for Google ChromeOS versions prior to 120.0.6099.314 (Platform Version: 15662.111)
 

Overview
Remote code execution vulnerabilities have been reported in LTS channel for ChromeOS which could be exploited by a remote attacker to execute arbitrary code on the targeted system.
 

Description
These vulnerabilities exist in LTS channel for ChromeOS Out of bounds component write in Streams API and Type Confusion in V8.A remote attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted Web page.
Successful exploitation of these vulnerabilities could allow remote attacker to execute arbitrary code on the targeted system.
 

Solution
Apply appropriate updates as mentioned in the advisory:
https://chromereleases.googleblog.com/2024/06/long-term-support-channel-update-for_10.html
 

Vendor Information
Google Chrome
https://chromereleases.googleblog.com/2024/06/long-term-support-channel-update-for_10.html
 

References
Google Chrome
https://chromereleases.googleblog.com/2024/06/long-term-support-channel-update-for_10.html
 

CVE Name
CVE-2024-5499
CVE-2024-5274

Read More

Threat Modeling and Security Architecture Analysis

 What is Threat Modeling?

It provides the software development team an attacker’s or hostile user’s viewpoint, as the threat modeling exercise aims at identifying entry and exit points that an attacker can exploit.

It also helps the team to make design and engineering tradeoff decisions by providing insight into the areas where attention is to be

prioritized and focused, from a security viewpoint.

 Benefits of Threat Modelling

•The primary benefit of threat modeling during the design phase of the project is that design flaws can be addressed before a 

  single line of code is written, thereby reducing the need to redesign and fix security issues in code at a later time.

•Once a threat model is generated, it should be iteratively visited and updated as the software development project progresses.

•In the design phase, threat models development commences as the software architecture teams identify threats to the software.

 Challenges of Threat Modelling

•Though the benefits of threat modeling are extensive, threat modeling does come with some challenges.

•Can be a time-consuming process when done correctly.

•Requires a fairly mature SDLC.

• Requires the training of employees to correctly model threats and address vulnerabilities.

•Is often deemed to not be a very preferential activity. Developers prefer coding and quality assurance personnel prefer testing \

over threat modeling.

•Is often not directly related to business operations and it is difficult to show demonstrable return on investment for threat models. 

 

Threat Modeling Process  

 

STRIDE category of threats 

	Goal	Description
S	Spoofing	Can an attacker impersonate another user or identity?
T	Tampering	Can the data be tampered with while it is in transit or in storage or archives?
R	Repudiation	Can the attacker (user or process) deny the attack?
I	Information Disclosure	Can information be disclosed to unauthorized users?
D	Denial of Service	Is denial of service a possibility?
E	Elevation of Privilege	Can the attacker bypass least privilege implementation and execute the software at elevated or administrative privileges?

 -----In Progress-

NOTE:The Information provided is on "as is" basis, without assurance of any kind. 

Read More