You are here

Home » Cybersecurity

Cybersecurity

TrickBot Takes a Hit in Recent Takedown Attempt

On Monday, a coalition of tech companies orchestrated a takedown attempt of TrickBot, currently one of the most successful malware-as-a-service operations. TrickBot survived the operation, with the command and control servers and domains that had been seized replaced the next day by new infrastructure. However, the operation appears to have had some effect on TrickBot, even if it was just temporal and limited. "Our estimate right now is what the takedown did was to give current victims a breather," a security researcher said.

SAP Releases October 2020 Security Updates

SAP has released security updates to address vulnerabilities affecting multiple products. An attacker could exploit some of these vulnerabilities to take control of an affected system. This includes an OS command injection vulnerability (CVE-2020-6364) affecting SAP Solution Manager and SAP Focused Run. CISA encourages users and administrators to review the SAP Security Notes for October 2020 and apply the necessary updates.

Microsoft Releases October 2020 Security Updates

Microsoft has released its monthly update to address vulnerabilities in its software. For this month, Microsoft has released security updates for Microsoft Windows, Microsoft Office and Microsoft Office Services and Web Apps, Microsoft JET Database Engine, Azure Functions, Open Source Software, Microsoft Exchange Server, Visual Studio, PowerShellGet, Microsoft .NET Framework, Microsoft Dynamics, Adobe Flash Player, Microsoft Windows Codecs Library.

Siemens SIPORT MP (ICSA-20-287-06)

CISA has published an advisory on a use of client-side authentication vulnerability in Siemens SIPORT MP. Versions 3.2.1 and prior are affected. Successful exploitation of this vulnerability could allow an authenticated attacker to impersonate other users of the system and perform (potentially administrative) actions on behalf of those users if the single sign-on feature (“Allow logon without password”) is enabled. Siemens has released an updated version of SIPORT MP and recommends users install this update on all affected systems.

Siemens Desigo Insight (ICSA-20-287-05)

CISA has published an advisory on SQL injection, improper restriction of rendered UI layers or frames, and exposure of sensitive information to an unauthorized actor vulnerabilities in Siemens Desigo Insight. All versions of this product are affected. Successful exploitation of these vulnerabilities could allow an attacker to retrieve or modify data and gain access to sensitive information. Fieldcomm Group recommends users restrict access to the computers or devices running the software. Siemens has identified specific workarounds and mitigations users can apply to reduce risk.

Fieldcomm Group HART-IP and hipserver (ICSA-20-287-04)

CISA has published an advisory on a stack-based buffer overflow vulnerability in Fieldcomm Group HART-IP and hipserver. For HART-IP Developer kit, release 1.0.0.0 is affected. For hipserver, release 3.6.1 is affected. Successful exploitation of this vulnerability could crash the device being accessed; a buffer overflow condition may allow remote code execution. Fieldcomm Group recommends users restrict access to the computers or devices running the software. Users of hipserver should immediately upgrade source code to v3.7.0 or later.

LCDS LAquis SCADA (ICSA-20-287-02) – Product Used in the Water and Wastewater and Energy Sectors

CISA has published an advisory on an out-of-bounds read vulnerability in LCDS LAquis SCADA. Versions prior to 4.3.1.870 are affected. Successful exploitation of this vulnerability could allow an attacker to execute code under the privileges of the application. LCDS recommends users update to Version 4.3.1.870 or later. CISA also advised on a series of measures to mitigate the vulnerability. Read the advisory at CISA.

MOXA NPort IAW5000A-I/O Series (ICSA-20-287-01) – Product Used in the Energy Sector

CISA has published an advisory on session fixation, improper privilege management, weak password requirements, cleartext transmission of sensitive information, improper restriction of excessive authentication attempts, and exposure of sensitive information to an unauthorized actor vulnerabilities in MOXA NPort IAW5000A-I/O Series. Firmware Version 2.1 or lower is affected.

Pages

Subscribe to Cybersecurity