Cybersecurity

Malware authors are really good at modifying malware code to evade detection by antivirus and other security products, including artificial intelligence and machine learning security engines. They also predictably incorporate trending news for their lures. So it comes as no surprise that miscreants are currently using coronavirus-themed news to bypass detection technologies. Specifically, BleepingComputer recently observed Emotet and TrickBot samples using strings from actual CNN news stories in their malware files.

CISA has published an advisory on stack-based buffer overflow and out-of-bounds read vulnerabilities in Delta Electronics Industrial Automation CNCSoft ScreenEditor. Versions 1.00.96 and prior are affected. Successful exploitation of these vulnerabilities could cause buffer overflow conditions that may allow information disclosure, remote code execution, or crash the application. Delta recommends updating to the latest version of CNCSoft v1.01.24 (with ScreenEditor v1.00.98) and restricting the interaction with the application to trusted files.

CISA advises that Microsoft has released out-of-band security updates to address a remote code execution vulnerability (CVE-2020-0796) in Microsoft Server Message Block 3.1.1 (SMBv3). A remote attacker could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review the resources and apply the necessary updates or workarounds. Read the advisory at CISA.

CISA has published an advisory on an authorization bypass through user-controlled key vulnerability in ABB Asset Suite. Versions 9.6 and prior, excluding 9.4.2.6 and 9.5.3.2, are affected. Successful exploitation of this vulnerability could allow an attacker access to unauthorized information in the application by direct resource access. ABB recommends users apply updates as soon as they are able. CISA also recommends a series of measures to mitigate the vulnerabilities.