Netizen is an award-winning ISO 27001:2013 and ISO 9001:2015 certified Service Disabled Veteran Owned (SDVOSB) company specializing in cybersecurity with offices and locations around the country. Our work is truly global as we support customers all across the U.S., Europe, Middle East, and Asia. We are America’s fastest growing cybersecurity company in 2019 and a national “Best Workplace” according to Inc. Magazine. We also received the Department of Labor HireVETS Platinum Medallion for our veteran-focused hiring, training, and retention programs in addition to numerous other accolades.
Allentown, PA: Netizen Corporation, an ISO 27001:2013, ISO 9001:2015, and CMMI Level 3 certified Veteran Owned provider of cybersecurity products and solutions, has hired Joseph Carr to the executive team and named him Director of Cybersecurity for the company. Joe is an adept cybersecurity engineering leader with over 20 years of professional experience in systems engineering, program management, and cybersecurity roles that were both technical and management focused in nature.
His primary responsibility at Netizen is the oversight and success of the U.S. Army PEO STRI cybersecurity engineering program. He also works with the company’s Chief Operating Officer (COO) and Chief Information Security Officer (CISO) to refine the company’s internal compliance programs and provide advisory support for all business operations.
He has a Master’s degree in Systems Engineering from Stevens Institute of Technology, a Bachelor’s degree in Business Administration from Drexel University, and holds CISSP-ISSEP, CISM, and CCSP certifications. Joe previously held a variety of cybersecurity leadership and engineering roles with companies in the defense market, managed complex acquisition programs at worldwide locations for the U.S. military, and was a lead cybersecurity engineer in Orlando, Florida with Netizen from 2017 to 2020. He is currently based at the Netizen location in Charleston, South Carolina.
America’s fastest-growing cybersecurity company, 2nd fastest-growing Veteran-owned company, and 47th fastest-growing private company overall in the nation according to the 2019 Inc. 5000 list of the nation’s most successful businesses, Netizen is a highly specialized cybersecurity solutions provider. They also develop innovative software products that include the award-winning AutoSTIG and Overwatch Governance Suite.
The company, a certified Service Disabled Veteran Owned Business (SDVOSB), is headquartered in Allentown, PA, with additional locations in Virginia (DC Metro), South Carolina (Charleston), and Florida (Orlando). In addition to being one of the fastest-growing businesses in the US, Netizen has also been named as one of the nation’s “Best Workplaces” by Inc. Magazine and is a US Department of Labor HIRE Vets Platinum Medallion awardee for veteran hiring and support for two years in a row. Learn more at Netizen.net.
Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing outside attack surface. Netizen’s Security Operations Center (SOC) has compiled four vulnerabilities from February that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2023-0882:
Improper Input Validation, Authorization Bypass in Kron Tech Single Connect on Windows. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and the Single Connect version 2.16. The Kron Technologies Single Connect product is a privileged access management suite for enterprise IT security. This is an IDOR (Insecure Direct Object References) vulnerability that doesn’t properly check & validate a user’s input which can allow an attacker to bypass authentication and gain access to other users’ data or records by the modification of a key value identifying the data. This could lead to a possible privilege escalation. This vulnerability does not require user interaction and has a high impact on the CIA Triad.
CVE-2022-23302:
JMSSink in all versions of Log4j 1.x is vulnerable to the deserialization of untrusted data. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and only affects Log4j 1.x when specifically configured to use JMSSink, an Apache application. This vulnerability allows an attacker with write access to the Log4j configuration or has access to an LDAP service that is referenced by the Log4j configuration, to send untrusted data to the JMSSink which allows JNDI requests that can result in an RCE (Remote Code Execution). This exploit could possibly lead to data exfiltration and a DOS (Denial of Service). Apache Log4j 1.2 reached end of life in August 2015, and it is suggested that it be upgraded to Log4j 2.
CVE-2022-42735:
Apache Software Foundation Apache ShenYu Improper Privilege Management vulnerability.
This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability doesn’t require user interaction to exploit this low-complexity attack. An insider threat actor with low-level admin privileges can create a user with admin privileges higher than their own because the vulnerability doesn’t assign, modify, track or check privileges properly. This can allow attackers to perform malicious activity on a system. This issue affects Apache ShenYu version 2.5.0, and it is advised to upgrade to Apache ShenYu 2.5.1 or apply the patch from here.
CVE-2022-23307:
Apache Chainsaw vulnerability previously named CVE-2020-9493 deserialization issue. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. Chainsaw is a GUI-based application that can be used to view log files. Versions of Chainsaw prior to version 2.0 were a component of the Apache Log4j version 1.2.x where the same vulnerability existed as well and was reported as CVE-2020-9493. The vulnerability can allow an attacker to send untrusted data which can result in an RCE (Remote Code Execution). The NIST rating reports a high impact on the CIA Triad.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
LVHN Suffers Ransomware Attack by Russian Cyber Gang
CISA Director Calls for Increased Accountability in Application/Hardware Development
How can Netizen help?
Phish Tale of the Week
Phishing attempts can often target specific groups that can be exploited by malicious actors and come in many different forms. In this instance, we see a phishing scam targeting Walmart customers with what appears to be a link to a loyalty survey. Once we complete the loyalty survey we are told we will receive a “Brand New FREE Bissell Plus Carpet Cleaner”. This survey apparently only takes a minute of our time, so why shouldn’t we click on the “Get Started Now” button? Fortunatently for us, there are plenty of signs that this email is a phishing scam.
Here’s how we know not to click on either of this link:
The first red flags in this message is the senders’ addresses. Always thoroughly inspect the sender’s address to ensure it’s from a trusted sender. In this case, the message comes from an email address we are unfamiliar with. In the future, review the sender’s address thoroughly to see if the email could be coming from a threat actor.
The second warning signs in this email is the messaging. This message tries to elicit a response by offering a free prize incentive for completing their loyalty survey. Phishing scams commonly use prizes and promises of free gifts to elicit an immediate response from their targets. Always be sure to thoroughly inspect the messaging of all emails in your inbox.
The final warning sign for this email is the lack of legitimate Walmart information. Fortune 500 companies and similar organizations standardize all email communications with customers. Support links, addresses, acceptable use policies, and other information is always provided at the bottom of each email, along with options to unsubscribe or change messaging preferences. This email lacks all signs of a credible Walmart email and can be immediately detected as a phishing attempt.
General Recommendations:
A phishing email will typically direct the user to click on a link where they will then be prompted to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via email.
Scrutinize your emails before clicking anything. Have you ordered anything recently? Does this order number match the one I already have? Did the email come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
Verify that the sender is actually from the company sending the message.
Did you receive a message or email from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email.
Do not give out personal or company information over the internet.
Do not click on unrecognized links or attachments. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.
Many phishing emails pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any email requesting immediate action should be vetted thoroughly to determine whether or not it is a scam. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, an attachment titled “Fix your account now” may draw the question “What is wrong with my account?” and prompt you to click a suspicious link.
Cybersecurity Brief
In this week’s Cybersecurity Brief:
LVHN Suffers Ransomware Attack by Russian Cyber Gang
The Lehigh Valley Health Network (LVHN) was hit by a suspected ransomware attack earlier this month. On Monday, February 20th, 2023, LVHN CEO and President Brian Nester commented, “Lehigh Valley Health Network has been the target of a cybersecurity attack by a ransomware gang, known as BlackCat, which has been associated with Russia. As of today, the attack has not disrupted LVHN’s operations. Based on our initial analysis, the attack was on the network supporting one physician practice located in Lackawanna County. We take this very seriously and protecting the data security and privacy of our patients, physicians and staff is critical.”
Reports from inside LVHN indicated that the initial breach targeted an LVHN subsidiary Delta Medix in Lackawanna County, PA. From there, threat actors were able to pivot across the network and expand their ransomware payload to multiple locations. LVHN’s IT team was quick to contain the intrusion and has reportedly refused to pay the ransom demanded by BlackCat. Nester later added that “Although our investigation is ongoing, as of today, our initial analysis shows that the incident involved a computer system used for clinically appropriate patient images for radiation oncology treatment and other sensitive information. BlackCat demanded a ransom payment, but LVHN refused to pay this criminal enterprise. We understand that BlackCat has targeted other organizations in the academic and healthcare sectors.”
Ransomware attacks like this have surged across the United States in the last few years, with sectors like healthcare and education facing the brunt of these intrusions. Many in the information security community have urged companies to further invest in backup technology to ensure that business is only disrupted or delayed by a few hours at max in the event of a ransomware attack. However, backups will not solve the issue of ransomware altogether.
BlackCat and other ransomware gangs often rely on human error to break into different organizations. Clicking on a bad email link or unknowingly inserting a malicious USB drive into a laptop could prove disastrous for any company’s IT security posture. Organizations must change how security is taught to employees and expand on continuous cybersecurity training for all staff. Employees that are exposed to threat actor attack methods like phishing scams and social engineering tactics are far more likely to scrutinize potential threats in the future and report them to their IT teams.
This is not the first time LVHN has suffered a cybersecurity incident. In 2021, LHVN sustained a major PII breach when a third-party file transfer service was hacked, exposing patient information such as DOB, address, social security numbers, and more.
“We are continuing to work closely with our cybersecurity experts to evaluate the information involved and will provide notices to individuals as required as soon as possible. Attacks like this are reprehensible and we are dedicating appropriate resources to respond to this incident.” said LVHN CEO Brian Nester when discussing LVHN’s response to the ransomware attack.
In conclusion, ransomware attacks like this are on the rise globally and will continue to single out sectors such as healthcare and education. Organizations must improve their security training for all staff immediately. Cultures centered around security and a cautious approach to potential IT threats will serve firms well in the long run.
CISA Director Calls for Increased Accountability in Application/Hardware Development
Software companies have focused on building applications quickly for far too long, with functionality as the main priority. Numerous firms have come under fire recently for having their applications exploited in ransomware attacks and other cyber intrusions. The Director of the Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), Jen Easterly, directed private corporations to bring security to the top of the discussion for application development. The CISA director even went as far as to suggest that corporations that continue to build applications insecurely may face fines and penalties if their software is leveraged for a cyberattack.
“Congress should advance legislation allowing software manufacturers to be held legally liable for the insecurity of their products, and it should also shield companies that develop secure software from legal liability.” This statement by Easterly on Monday follows a renewed push by CISA to convince private companies to build secure applications from the ground up rather than try to bolt on or in many cases place “cybersecurity tape” over gaping holes in their applications. Easterly later added, “Government can work to advance legislation to prevent technology manufacturers from disclaiming liability by contract, establishing higher standards of care for software in specific critical infrastructure entities and driving the development of a safe harbor framework to shield from liability companies that securely develop and maintain their software products and services.”
This legislation would shift the liability of security from the end-user to the manufacturing corporation. Users often accept liability and terms of service agreements when unpackaging new tech hardware or software online. Few people actually read these policies in their entirety and unknowingly accept ludicrous liability policies that place the burden of security on the user rather than the corporation developing the product.
At the same time, legislation like this would assure companies that take the necessary steps to securely develop applications/hardware would not be penalized if a sophisticated threat actor was able to breach their systems. This “safe harbor” would set acceptable guidelines for companies to develop new applications or hardware. This way, companies that ultimately do end up getting breached will not face the full brunt of public scrutiny and penalties as long as they follow best practices set by CISA.
Overall what Jen Easterly is trying to champion is a worthy cause in practice. However, original proponents of this fight date back to 2002, with many saying that special interest groups and tech start-ups everywhere will fight legislation like this tooth and nail. Putting a new focus on security in applications and hardware will result in more labor costs and longer production cycles, which will ultimately be a net negative for shareholder value. Although, more secure products will reduce the likelihood of a breach and potential negative impact caused by similar cyber intrusions. It remains to be seen whether or not lawmakers will heed the advice of CISA’s director and increase cybersecurity accountability for software companies.
For more information, check out the rest of the article here.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Efficiently digesting vulnerability reports can make or break a company’s security posture. Not entirely understanding a vulnerability or how to patch it can not only be discouraging for IT professionals, but it can leave an opening for malicious actors. Learning to look deeper than the graphs and indicative colors of a vulnerability report is a worthwhile skill to develop for any security-conscious individual or group.
What is a vulnerability?
Before breaking down a vulnerability report, it would help to have a straightforward definition of what a vulnerability is. A vulnerability, by definition, is any weakness or soft spot in a logical system. Vulnerabilities can arise just about anywhere; however, they are often a result of flawed computer code or loose controls for authentication or authorization. Security professionals will generally utilize the Common Vulnerability Scoring System (CVSS) to attempt to give vulnerabilities a numerical, zero through ten, severity score. CVSS scores are generated by understanding a specific vulnerability’s impact and attack metrics. Typically, the higher the CVSS score, the greater the vulnerability’s impact on confidentiality, integrity, and availability.
How do you begin remediation?
Prioritizing vulnerability remediation, while seemingly simple on the surface, goes deeper than just comparing the CVSS scores assigned to the vulnerabilities. Firstly, understand that even the most advanced, industry-standard tools will sometimes generate false positive results. To remedy this issue and prevent unnecessary patching, there are typically checks, or proof-of-concept (PoC) tests to conduct. Most proof-of-concept exercises can be found by searching various exploit databases for the CVE number related to the vulnerability.
Once the chance of false positive results is removed, you will be left with your ‘true’ vulnerability report. Depending on the size of your target selection, this report could have a handful or several hundred vulnerabilities, which will be unique to your organization’s situation. To prioritize these vulnerabilities, having a short-term and long-term security plan is helpful. A vulnerability like MS17-010, a critical Windows remote code execution, will likely take precedence over a vulnerable cipher suite found on an internal web server.
Where do you find information on different CVEs?
After creating your short-term and long-term security goals, it is time to act toward them. The steps taken to patch a vulnerability can vary drastically. Having the CVE number handy will improve your chances of finding helpful information. Generally, some of the most useful information for a specific vulnerability will be found on applicable vendor websites/ support forums, security blogs, or under the ‘references’ section of a CVE database. While remediating some vulnerabilities will be done with the click of an ‘update’ button, not all will be so willing to leave. Remediating vulnerabilities can, at times, require extensive research or outreach.
Creating a logical remediation plan will not only save you time, but also endless frustration. Assuming the absence of critical vulnerabilities, it can be helpful to patch vulnerabilities by host instead of strictly by CVSS score. If a specific node is noticeably overcontributing to your vulnerability report, this can be an excellent starting point for your remediation journey. Spooling up a virtual instance of the troubled node and tackling vulnerabilities from a system view will cut off some space from your following vulnerability report and lower your network’s overall attack surface. After all, nodes with higher vulnerability counts are significantly more likely to be targeted by malicious actors.
How do you test vulnerabilities before patching?
Industry best practices would tell us it is never a good idea to patch without testing. While remediating vulnerabilities as quickly and efficiently as possible is the goal of any security-conscious team, issues can arise without proper testing techniques in place. Creating a denial-of-service condition by an unexpected update during business hours or even an unironed-out bug in the latest patch isn’t necessarily the most efficient patching method. By standing up separate instances of nodes or services, you’re effectively creating a test bed for your production environment where hiccups in software won’t come at the cost of valuable uptime.
Discussing remediation almost always leads to the awkward discussion of currently unpatchable vulnerabilities. Whether the reason for not patching is due to the vulnerability not having a current patch available or the risk associated with patching is too significant, it places a heavy weight on a standard remediation plan. Though discussing risk management entirely may be out of the scope of this article, it’s essential to understand critical factors such as the annual loss expectancy of a vulnerability. When the annual loss expectancy is lower than the cost to patch, or even the potential cost to patch should something go wrong, the more educated decision may be to accept risk.
How do you accept risk without compromising your systems?
Accepting risk is all about doing so as intelligently as possible. Accepting risk doesn’t mean accepting an exploit of the vulnerability. There are endless ways to go about protecting a still-vulnerable asset. Utilizing firewall whitelisting or installing host-based IDS/IPS on the system is a way to compensate for the lack of a patch. Generating more in-depth logging routines for the device can also help ensure that if an exploit is conducted, it is immediately noticed by your organization’s security team. Frequently, especially with vulnerability reports, patching becomes a binary step. The device is viewed by whether it is patched or not, but that isn’t quite the case in a real-world production environment. By utilizing compensating methods to reduce risk, IT professionals can accept and mitigate risk more intelligently in their environments.
Conclusion:
Becoming more familiar with your vulnerability report will help you better to understand your vulnerabilities, networks, and systems. As well as providing educated decisions on how and when to patch will prove invaluable to creating a secure and productive environment. To speak to a security professional about starting vulnerability scanning, reviewing vulnerability data, or any other security service, feel free to reach out to the Netizen team.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
The Cybersecurity Maturity Model Certification (CMMC) 2.0 is a certification program developed by the U.S. Department of Defense (DoD) to assess the cybersecurity practices of contractors who handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The program aims to protect sensitive government information and ensure that contractors handling this information have appropriate cybersecurity measures.
The CMMC 2.0 model consists of multiple levels, ranging from basic cybersecurity hygiene to advanced threat detection and response capabilities, and includes 17 domains of cybersecurity practice. To be certified, contractors will either self-assess for Level 1 or undergo a third-party assessment and demonstrate compliance with the relevant CMMC 2.0 requirements for Levels 2 and 3. This program is mandatory for all DoD contractors and is designed to be a continuous process, with regular assessments to ensure that contractors maintain their certification and stay up-to-date with the latest cybersecurity best practices.
What are the 3 levels of CMMC 2.0?
The CMMC 2.0 framework is broken down into 3 different levels ranging from basic cyber hygiene to adhereing with advance information security controls outlined in NIST Special Publication 800-172.
Level 1: Foundational Security. Basic safeguarding of Federal Contracting Information (FCI) in FAR Clause 52.204-21, 17 practices
Level 2: Advanced Security. Aligns with the 110 controls and security requirements of NIST 800-171.
Level 3: Expert Security. Focsued on the reduction of Advanced Persistent Threats (APTs). Controls will align with requirements laid out in NIST SP 800-172.
Companies can take the following steps to prepare for the Cybersecurity Maturity Model Certification 2.0 (CMMC) process:
Assess current cybersecurity posture, review CMMC 2.0 controls for applicable level, and identify any gaps in compliance with the CMMC requirements. Organizations that first prioritize understanding the CMMC 2.0 requirements their will need to meet will immediately put themselves on the right path.
Develop a plan to address any identified gaps, including a timeline for implementation. Setting attainable targets for compliance will help reduce the stress and burden that comes with meeting CMMC 2.0 requirements.
Train employees on cybersecurity best practices, including how to identify and report potential threats.
Implement technical controls, such as firewalls, antivirus software, and intrusion detection systems, to safeguard their networks and systems.
Develop incident response and business continuity plans to prepare for and respond to potential security breaches.
Regularly monitor and audit their systems and networks to ensure they comply with the CMMC 2.0 requirements and detect and respond to any potential threats.
Lastly, consider hiring a third-party assessor to conduct an assessment, help identify vulnerabilities, and ensure compliance with the CMMC 2.0 standards. Third-party assessors are a great resource to help prioritize which controls your organization should focus on, as well as updating applicable documentation to meet CMMC 2.0 standards.
Conclusion:
Overall, CMMC 2.0 can seem like a daunting framework for any company to tackle. These compliance requirements were created with information security best practices as the foundation. Companies that have been adhereing to industry best standards will have little trouble configuring their environments to meet compliance. Even firms that have not been heavily investing into their cybersecurity posture can still achieve CMMC 2.0 compliance with proper preparation, an understanding of the controls, and a well thought out timeline to remediate any gaps in compliance.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing outside attack surface. Netizen’s Security Operations Center (SOC) has compiled five vulnerabilities from January that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2023-23314:
Zdir v3.2.0 allows attackers to execute arbitrary code. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. The Zdir gives access to the file system index. An upload vulnerability within the api/upload component of the Zdir version 3.2.0 allows an attacker to establish an RCE (Remote Code Execution) through a .ssh file. This vulnerability requires no user interaction and has a high impact on the CIA Triad.
CVE-2016-1018:
Adobe Flash Player Stack-based buffer overflow. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability affects Adobe Flash Player in versions before 18.0.0.343 and 19.x through 21.x before 21.0.0.213 on Windows and OS X and before 11.2.202.616 on Linux. User interaction is required in order to perform the attack. The vulnerability is in how the JPEG-XR file is handled. There is a failure in how the index is checked within the bounds of a buffer, thus causing a possible buffer overflow. This vulnerability can lead to an attacker leveraging a system through the execution of arbitrary code.
CVE-2022-34324:
Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability affects an unknown part of the add Currencies, Payment Order, and Transfer History component of the Sage XRT Business Exchange version 12.4.302. The vulnerability doesn’t require user interaction but does require an attacker to be authenticated in order to inject the malicious data in SQL queries.
CVE-2020-9910:
Multiple issues were addressed with improved logic in Apple’s Safari Web Browser. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and affects iOS 13.6 and iPadOS 13.6, tvOS 13.4.8, watchOS 6.2.8, Safari 13.1.2, iTunes 12.10.8 for Windows, iCloud for Windows 11.3, iCloud for Windows 7.20. Although this vulnerability has been fixed, it could possibly allow a malicious attacker with arbitrary read & write abilities to bypass Pointer Authentication. Successful exploitation could allow RCE. The attack complexity is low and can have a high impact on the CIA Triad.
CVE-2021-22048:
The vCenter Server contains a privilege escalation vulnerability in the IWA (Integrated Windows Authentication) authentication mechanism. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability is within the IWA of vCenter Server and allows for a non-admin authenticated attacker to elevate privileges to a higher privileged group and poses a high risk to the CIA Triad.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing outside attack surface. Netizen’s Security Operations Center (SOC) has compiled four vulnerabilities from December that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2022-44635:
Apache Fineract allowed an authenticated user to perform remote code execution. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. The Apache Fineract, an open-source software for financial services, has a vulnerability in its File Upload Handler component that allows a path traversal attack which an attacker can leverage to run remote code on a system and has a high impact upon the CIA Triad. This vulnerability affects versions 1.8.0 and earlier. It is recommended that Apache Fineract be upgrade to version 1.8.1.
CVE-2021-25642:
ZKConfigurationStore which is optionally used by Apache Hadoop YARN deserializes data obtained from ZooKeeper without validation. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and is found in versions 2.10.1, 3.2.3, 3.3.3. An Attacker that can access ZooKeeper can manipulate input to the application leading to the desterilizing of input that isn’t verified properly. This allows the attacker to run randomly chosen commands.
CVE-2022-38336:
An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. This vulnerability has a NIST CVSSv3 base score rating of 8.1/10. If the default configuration is used, version 22.1 and earlier will not check the remoter server host key correctly when an SFTP or SSH session is initiated. This vulnerability can allow an attacker to perform a MITM (Man In The Middle) attacker leading to leveraging the ability to log into other remote servers.
CVE-2017-14432:
An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 Router V4.1 build 17030317. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. An attacker can enter a specially crafted HTTP POST to get privilege escalation to a root shell. The attacker configures OpenVPN through the POST “/goform/net\_Web\_get_value” which gives the attacker root user privileges and allows injected commands to run as root. The attack is not complex in nature and doesn’t require user interaction.
CVE-2022-34271:
A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and affects Apache Atlas versions from 0.8.4 to 2.2.0. The Apache Atlas is an open source framework to help scientists & engineers classify & govern data assets. The vulnerability allows the manipulation of input to perform a path directory traversal to restricted directories. This vulnerability can have a high impact on the CIA Triad, Confidentiality, Integrity & Accessability.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing outside attack surface. Netizen’s Security Operations Center (SOC) has compiled four vulnerabilities from November that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2022-42896:
Linux Kernel Memory Leak Leading To RCE via Bluetooth. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This is a Use-After-Free (UAF) vulnerability that incorrectly uses the dynamic memory of a program by not clearing the memory pointer letting an attacker hack the program. The vulnerability is within the Linux Kernel and lets an attacker use the blue-tooth l2cap_connect and l2cap_le_connect_reqfunctions to execute RCE when within the proximity of a victim. The NIST Attack Complexity score rating for this vulnerability is rated as low.
CVE-2022-44784:
File Inclusion vulnerability in the program Appalti & Contratti version 9.12.2. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This web platform utilizes several web applications to support the Italian public administration. This vulnerability has a low attack complexity and does not require user interaction. The platform has a set of services which can be manipulated through user input to allow a file inclusion attack. This can then lead to an attacker gaining RCE (Remote Code Execution) on the server.
CVE-2022-26717:
A Use-After-Free (UAF) issue was addressed with improved memory management in tv OS 15.5, watch OS 8.6, iOS 15.5 and iPad OS 15.5, mac OS Monterey 12.4, Safari 15.5, iTunes 12.12.4 for Windows. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability is found in webkitgtk (A port of WebKit which is a web browser engine used by Safari, Mail. App Store and other apps on MacOS, iOS, and Linux). An improper input validation allows an attacker who has network access to gain arbitrary code execution.
CVE-2022-3446:
Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10 and has a high impact on confidentiality, integrity, and availability. A successful exploitation requires user interaction and a manipulation of input that can lead to a buffer overflow condition which can allow an attacker to gain unauthorized access to a network.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Allentown, PA: Netizen Corporation, an ISO 27001:2013, ISO 9001:2015, and CMMI Level 3 certified provider of cybersecurity and related solutions for defense, government and commercial markets, has for the fifth year in a row received a HIRE Vets Platinum Medallion award from the U.S. Department of Labor for the hiring, retention, support and training of military veterans and families. This level of award is given only to select companies demonstrating superior commitments to veteran employment and the military/veteran community. Netizen employs a significant percentage of veterans while providing free training, college scholarships, and paid internships to help veterans and military families obtain careers in high-demand technical fields such as cybersecurity.
The HIRE Vets Medallion program was established under the Honoring Investments in Recruiting and Employing American Military Veterans (HIRE Vets) Act signed into law on May 5, 2017 to recognize employers who hire, retain and support military veterans. The Platinum Medallion is the highest level of award a company can receive for this program and the citation states that “[Netizen] has demonstrated a model of patriotism worthy of praise as well as a recognition of the value veterans bring to the workplace.”
“Netizen is proud to employ a significant portion of military veterans. We acknowledge the diverse array of skills, talents, and backgrounds that this provides us with as a company. Such diversity of thought and experience is truly something that sets us apart while also providing fellow military veterans and families with opportunities for learning and advancement,” said Michael Hawkins, Netizen’s CEO and a U.S. Army veteran.
About Netizen Corporation: Once America’s fastest-growing cybersecurity firm, 2nd fastest-growing Veteran-owned company, and a top-50 fastest-growing private company overall according to the 2019 and 2020 Inc. 5000 lists of the nation’s most successful businesses, Netizen provides specialized cybersecurity solutions for government, defense, and commercial markets. They also develop products such as the award-winning Overwatch Governance Suite.
The company, a certified Service Disabled Veteran Owned Business (SDVOSB), is based in Allentown, PA with additional locations in Virginia, South Carolina, and Florida. In addition to having been one of the fastest-growing businesses in the US, Netizen has also been named a national “Best Workplaces” by Inc. Magazine and has received the US Department of Labor HIRE Vets Platinum Medallion award for veteran hiring, retention, and community involvement five years in a row. Learn more at Netizen.net.
POINT OF CONTACT Tristan Boheim Account Executive 1-800-450-1773 press@netizen.net
Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing outside attack surface. Netizen’s Security Operations Center (SOC) has compiled five vulnerabilities from October that should be immediately patched or addressed if present in your environment. Detailed writeups below:
CVE-2021-27855:
FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 may allow an attacker with valid credentials to get a login foothold and then leverage administration privilege escalation. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. The older versions of FatPipe may be affected as well. This vulnerability doesn’t require user interaction and the complexity of the attack is considered low. The FatPipe software allows companies to centrally manage their WAN’s (Wide Area Networks).
CVE-2022-23642:
Sourcegraph is a code search and navigation engine for developers. Sourcegraph prior to version 3.37 is vulnerable to RCE (Remote Code Execution) in the `gitserver` service. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. The service works as a git exec proxy and the vulnerability causes a failure to restrict an attacker from calling ‘git config’ that allows an attacker to set the git ‘core.sshCommand’ option to allow a connection. The exploitation depends upon how Sourcegraph is deployed. The attacker may be able to make an HTTP request to the gitserver and exploit it. A POC Is available on GitHub… https://github.com/Altelus1/CVE-2022-23642
CVE-2022-41082:
Microsoft Exchange Server Remote Code Execution Vulnerability. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability allows an attacker to get RCE (Remote Code Execution) when the Exchange Powershell is accessible to an attacker. This vulnerability can be chained together with CVE-2022-41040 in an exploit. This vulnerability doesn’t require user interaction and the complexity of attack is considered low.
CVE-2022-41040:
Microsoft Exchange Server Elevation of Privilege Vulnerability. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. This vulnerability is one of two reported zero-day vulnerabilities that affect Microsoft Exchange Server 2013, 2016 & 2019 and it is an SSRF (Server-Side Request Forgery) vulnerability. This vulnerability can allow an attacker with valid credentials to remotely trigger the vulnerability CVE-2022-41082. But valid credentials are needed to exploit either of these two vulnerabilities.
CVE-2021-3100:
The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges. This vulnerability has a NIST CVSSv3 base score rating of 8.8/10. After Amazon deployed it’s Log4j patches, this vulnerability which allowed an attacker to escape the container and perform privilege escalation, was discovered.
Conclusion:
In conclusion, software vulnerabilities are a common nuisance to IT and security teams everywhere. Organizations that prioritize the remediation and patching of these vulnerabilities will drastically reduce their attack surface and ensure no doors into their environment are left unlocked.
How Can Netizen Help?
Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time.
We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type.
Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.
Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.
Netizen Blog and News 
You must be logged in to post a comment.