Tecplix ThreatTrack Insights -April I

1. Critical Rust Vulnerability (CVE-2024-24576) Enables Remote Command Injection on Windows

A critical vulnerability (CVE-2024-24576) has been found in the Rust standard library that exposes Windows systems to remote command injection attacks. The vulnerability arises from improper argument escaping when invoking batch files (.bat and .cmd extensions) using the Command API.

Key Takeaways

• Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction.
• The vulnerability affects all Rust versions before 1.77.2 on Windows when programs execute batch files (.bat or .cmd) with untrusted arguments.
• The Rust Security Response team has addressed the vulnerability in version 1.77.2 by improving escaping logic and returning an error for unsafe arguments.

Impact

Successful exploitation could allow attackers to:

• Gain unauthorized access to systems
• Install malware
• Steal sensitive data
• Disrupt critical operations

Who is Affected

• Developers using Rust versions before 1.77.2 on Windows, especially those working with untrusted user input.
• Users running applications built with vulnerable Rust libraries on Windows.

Recommendation

Update the Rust standard library to version 1.77.2 or later.

2. Fortinet Security Patch Addresses Critical FortiClientLinux Vulnerability

Fortinet has released security patches to address a critical vulnerability (CVE-2023-45590) in FortiClientLinux that could allow attackers to remotely execute malicious code on affected devices. This vulnerability carries a CVSS score of 9.4 out of 10, indicating a severe risk.

Key Takeaways

• Unpatched FortiClientLinux devices are vulnerable to remote code execution attacks.
• Attackers could exploit this vulnerability to gain complete control over affected systems.
• Fortinet has released patches to address this vulnerability.

Impact

A successful attack could allow attackers to:

• Steal sensitive data
• Disrupt operations
• Install malware

Who is Affected

Users of the following FortiClientLinux versions:

• 7.0.3 through 7.0.4
• 7.0.6 through 7.0.10
• 7.2.0

Recommendation

All users of the affected FortiClientLinux versions are strongly encouraged to update their systems to the latest version immediately (7.0.11 or 7.2.1 or above).

https://docs.fortinet.com/document/forticlient/7.2.4/linux-release-notes/912707/installing-forticlient-linux

3. Enterprise Security Architecture: Building A Secure Foundation

In today’s digital landscape, businesses confront a multitude of cybersecurity threats that can disrupt operations and compromise sensitive data. To confront these threats establishing a robust Enterprise Security Architecture (ESA) becomes essential for resilience. This blog delves into the critical elements of an effective ESA, offering a roadmap for identifying, assessing, and mitigating security risks.

Managing Security Risks: A Four-Step Process

Effectively managing security risks necessitates a systematic approach comprising four key steps:

Risk Identification:

• Proactively identify potential threats, vulnerabilities, and weaknesses.
• Employ risk assessment methodologies and vulnerability scanning tools.
• Prioritize risks based on likelihood and potential impact.

Risk Assessment:

• Analyze the severity of each identified risk, considering its impact on operations, financial stability, and reputation.
• Categorize risks based on severity and likelihood for focused mitigation efforts.

Risk Treatment:

• Develop tailored controls, leveraging technical, administrative, and physical measures.
• Implement security controls like firewalls and intrusion detection systems.
• Establish administrative and procedural controls to foster a security-centric culture.

Risk Monitoring:

• Continuously monitor the security environment for emerging threats.
• Utilize security monitoring tools like SIEM systems for real-time analysis.
• Regularly review and update the risk management framework.

Strategies for Effective Risk Management...

4. Critical RCE Vulnerability Exploited in Palo Alto Networks GlobalProtect Gateways (CVE-2024-3400)

Palo Alto Networks has identified a critical remote code execution (RCE) vulnerability (CVE-2024-3400) actively exploited in the wild. This vulnerability impacts PAN-OS software used in GlobalProtect gateways.

Key Takeaways

• Unauthenticated attackers can exploit this vulnerability to gain full control (root privileges) of affected firewalls.
• The vulnerability has a CVSS score of 10.0, indicating maximum severity.
• Palo Alto Networks is aware of limited targeted attacks exploiting this flaw.

Impact

Successful exploitation of this vulnerability could allow attackers to:

• Compromise Palo Alto Networks firewalls.
• Move laterally within a network.
• Deploy malware or steal sensitive data.

Who is Affected

This vulnerability affects the following versions of PAN-OS with GlobalProtect gateway and device telemetry features enabled:

• PAN-OS versions below 11.1.2-h3
• PAN-OS versions below 11.0.4-h1
• PAN-OS versions below 10.2.9-h1

Recommendation

• Update the software regularly with newly released patches.
• Implement IDS/IPS to detect and prevent unusual activity in the

network.

• Please find the patches for the affected software https://security.paloaltonetworks.com/CVE-2024-3400

5. Critical Vulnerabilities in Microsoft Edge: Update Now!

Critical vulnerabilities have been found affecting Microsoft Edge browsers, leaving users susceptible to remote attacks.

Key Takeaways

Multiple vulnerabilities (CVE-2024-3158, CVE-2024-29049, CVE-2024-3156, CVE-2024-3159, CVE-2024-29981) allow attackers to:

• Spoof elements and perform misleading attacks (CVE-2024-29981, CVE-2024-29049).
• Execute malicious code and compromise systems (CVE-2024-3158, CVE-2024-3159).
• Bypass security restrictions (CVE-2024-3156).
• Attackers can exploit these vulnerabilities by tricking users into visiting malicious websites.

Impact

These vulnerabilities pose a severe risk to users, potentially leading to:

• System compromise and data breaches.
• Deceptive attacks where attackers impersonate legitimate entities.
• Bypassing security measures and gaining unauthorized access.

Who is Affected

• Users of Microsoft Edge Extended Stable versions prior to 122.0.2365.120.
• Users of Microsoft Edge Stable versions prior to 123.0.2420.81.

Recommendation

Apply appropriate software fixes as available on the vendor website: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3156

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3158

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3159

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29049

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29981

In Crisis?

If you suspect a compromise or face a critical security issue, connect with us to unlock rapid, expert protection. Your Security and Business Continuity is our top Priority!

Get in touch with our security team by filling out this form or call at +91 6366 600 700.