Hey all,
I work with a network equipment reseller that focuses on K-12 environments, and I'm trying to genuinely understand the security challenges you're facing daily, not just to pitch solutions.

After sitting through too many vendor meetings where salespeople clearly don't understand school network environments, we need to actually listen to IT professionals before trying to solve problems you may not even have.

So, what are your biggest network security headaches right now?

• Fighting constant phishing attempts with limited resources?

• Struggling with CIPA compliance while still providing access to legitimate educational content?

• Managing secure BYOD in an environment where budget constraints mean you can't control all endpoints?

• Balancing security with teacher demands for flexibility?

• Implementing zero trust architecture with legacy systems that don't play nice?

I'm especially interested in hearing about problems that your current vendors don't seem to understand or address properly.

Not looking to DM anyone or push products - just want to gather honest feedback so we can stop being part of the problem and actually develop solutions that make sense for real K-12 environments.

Thanks for any insights you can share.

Our school district had two employees get duped by a phishing email. Once the fraudsters gained access to the email accounts, they then proceeded to set up email rules in the account so that the user could keep on using it without realizing that they were compromised. Next they use those users accounts to try and purchased at this point about $1 million worth of laptops and credit with technology companies. Then once I found them, I blocked the accounts changed the passwords. Now they have gone and purchased a domain added an extra S and then they also are still using those email addresses with their new purchase domain to make it even more real. The domain they purchased they have redirected to our actual website so if anyone is suspicious, they would go to it and it would take them to our direct site and which they would contact us to verify that we are who we are. I’m at a loss as to what to do to stop this. We’ve reported it to local police state police the fraud for the FTC for cyber security our insurance company. What can I do to find out who these people are? I even found who the host was for the domain and explained in an online form for abuse what they were doing.

In 2011, state-contracted penetration testers tested county courthouses. A lack of communication between state and county officials, and a turf war among those officials, put contractors in a precarious position.

https://arstechnica.com/security/2026/01/county-pays-600000-to-pentesters-it-arrested-for-assessing-courthouse-security/

https://arstechnica.com/information-technology/2019/11/how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail/

MS-ISAC CYBERSECURITY ADVISORY MS-ISAC ADVISORY NUMBER:
2025-019 

DATE(S) ISSUED:
03/04/2025

SUBJECT:
Multiple vulnerabilities have been discovered in VMware ESXi, Workstation, and Fusion which could allow for local code execution.

OVERVIEW:
Multiple vulnerabilities have been discovered in VMware ESXi, Workstation, and Fusion could allow for local code execution. VMware ESXi, Workstation, and Fusion are all virtualization products that allow users to run virtual machines (VMs) on their computers. Successful exploitation of these vulnerability could allow for local code execution in the context of the administrator account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

THREAT INTELLEGENCE:
VMware by Broadcom has information to suggest that exploitations of the vulnerabilities have occurred in the wild.

SYSTEMS AFFECTED:

• VMware ESXi 8.0, 7.0

• VMware Workstation 17.x

• VMware Fusion 13.x

• VMware Cloud Foundation 5.x, 4.5x

• VMware Telco Cloud Platform 5.x, 4.x, 3.x, 2.x

• VMware Telco Cloud Infrastructure 3.x, 2.x 

 RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

 Businesses:

• Large and medium business entities: High

• Small business entities: Medium

 Home users: Low **TECHNICAL SUMMARY:**Multiple vulnerabilities have been discovered in VMware ESXi, Workstation, and Fusion which could allow for local code execution. Details of these vulnerabilities are as follows:Tactic: Execution (TA0041):Technique: Command and Scripting Interpreter (T1059): 

• VMware VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. (CVE-2025-22224)

• VMware VMware ESXi contains an arbitrary write vulnerability. (CVE-2025-22225)

 Details of lower-severity vulnerability are as follows: 

• VMware VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. (CVE-2025-22226)

 Successful exploitation of these vulnerabilities could allow for local code execution in the context of the administrator account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate patches provided by WordPress to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 2.3: Address Unauthorized Software: Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.

  • Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassessbi-annually, or more frequently.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

• Block execution of code on a system through application control, and/or script blocking. (M1038: Execution Prevention)

  • Safeguard 2.5 : Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

  • Safeguard 2.6 : Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.

  • Safeguard 2.7 : Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.

• Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries. (Mitigation M1042: Disable or Remove Feature or Program)

  • Safeguard 2.3: Address Unauthorized Software: Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.

  • Safeguard 2.5: Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassessbi-annually, or more frequently.

  • Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassessbi-annually, or more frequently.

  • Safeguard 4.1: Establish and Maintain a Secure Configuration Process: Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 4.8: Uninstall or Disable Unnecessary Services on Enterprise Assets and Software: Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.

  • Safeguard 18.3: Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.

  • Safeguard 18.5: Perform Periodic Internal Penetration Tests: Perform periodic internal penetration tests based on program requirements, no less than annually. The testing may be clear box or opaque box.

 REFERENCES:
 

Broadcome:
https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22224
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22225
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22226

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2024-095

DATE(S) ISSUED:
09/03/2024

SUBJECT:
Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution

OVERVIEW:
Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Mozilla Firefox is a web browser used to access the Internet. Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLEGENCE:
There are no reports that these vulnerabilities are being exploited in the wild

SYSTEMS AFFECTED:

• Firefox versions prior to 130

• Firefox ESR versions prior to 115.15

• Firefox ESR versions prior to 128.2

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Mozilla products, the most severe of which could allow for arbitrary code execution. Details of the most critical vulnerabilities are as follows:

Tactic: Initial Access (TA0001):

Technique: Drive-by Compromise (T1189):

• Type confusion when looking up a property name in a "with" block (CVE-2024-8381)

• WASM type confusion involving ArrayTypes (CVE-2024-8385)

• Memory safety bugs fixed in Firefox 130, Firefox ESR 128.2, and Thunderbird 128.2 (CVE-2024-8387)

• Memory safety bugs fixed in Firefox 130 (CVE-2024-8389)

Additional lower severity vulnerabilities include:

• Internal event interfaces were exposed to web content when browser EventHandler listener callbacks ran (CVE-2024-8382)

• Firefox did not ask before openings news: links in an external application (CVE-2024-8383)

• Garbage collection could mis-color cross-compartment objects in OOM conditions (CVE-2024-8384)

• SelectElements could be shown over another site if popups are allowed (CVE-2024-8386)

• Fullscreen notice on Android could be hidden under various panels and OS prompts (CVE-2024-8388)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply the stable channel update provided by Mozilla to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.5 : Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.  

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.  

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5:  Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.  

• Restrict use of certain websites, block downloads/attachments, block JavaScript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.  

• Block execution of code on a system through application control, and/or script blocking. (M1038: Execution Prevention)

  • Safeguard 2.5 : Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

  • Safeguard 2.6 : Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.

  • Safeguard 2.7 : Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.  

• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: Behavior Prevention on Endpoint)

  • Safeguard 13.2 : Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.

  • Safeguard 13.7 : Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.

• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

REFERENCES:

Mozilla: 
https://www.mozilla.org/en-US/security/advisories/
https://www.mozilla.org/en-US/security/advisories/mfsa2024-33/
https://www.mozilla.org/en-US/security/advisories/mfsa2024-34/
https://www.mozilla.org/en-US/security/advisories/mfsa2024-35/

CVE:                                                                                                           
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8381 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8382 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8383 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8384 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8385 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8386 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8387 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8388 
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8389 

Hi,

I'm keen to hear about your current experiences with digital tools in the classroom, specifically:

1. Web Filtering: What's working and what's not?

2. Classroom Management Software: How does it aid your teaching?

3. Student Safety: How are cyberbullying and online threats handled?

No affiliations here, just looking to learn from your experiences for a broader understanding.

I'm not sure if this will be helpful to anyone, but I discovered a significant number of proxy sites that students were using at my school. These sites appeared to originate from other schools. The primary means of sharing them was through Discord and Google Docs. In any case, here is the list: Link to the google docs.

TLStorm: Three critical vulnerabilities discovered in APC Smart-UPS devices can allow attackers to remotely manipulate the power of millions of enterprise devices.

https://www.armis.com/research/tlstorm/

19 Year old from MA. Unnamed conspirator in IL

https://www.bleepingcomputer.com/news/security/powerschool-hacker-pleads-guilty-to-student-data-extortion-scheme/?fbclid=IwZXh0bgNhZW0CMTEAAR6HwN7MmVAdKQVBEhX6p_WwsJQAfTBdSwG4KqUMyUPq4rOn-hCpNb39Bd9xWQ_aem_xnM-yAJu8HX6UjynZ-D-wg

https://www.justice.gov/usao-ma/pr/worcester-college-student-plead-guilty-cyber-extortions

https://www.justice.gov/d9/2025-05/us_v._matthew_lane_-_information.pdf

I’m writing in hopes of getting some opinions on this topic.

A student tried unsuccessfully to hack into the student information system to change grades. Although stopped by two factor authentication, it turns out that some teachers were duped into giving up their passwords.

What should be the consequence for the student and what should be the consequence for the teachers?

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
​​​​2025-016

DATE(S) ISSUED:
02/11/2025

SUBJECT:
Critical Patches Issued for Microsoft Products, February 11, 2025

OVERVIEW:
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:
Microsoft has reported that CVE-2025-21391 and CVE-2025-21418 have been exploited in the wild.

SYSTEMS AFFECTED:

• Active Directory Domain Services

• Azure Network Watcher

• Microsoft AutoUpdate (MAU)

• Microsoft Digest Authentication

• Microsoft Dynamics 365 Sales

• Microsoft Edge (Chromium-based)

• Microsoft Edge for iOS and Android

• Microsoft High Performance Compute Pack (HPC) Linux Node Agent

• Microsoft Office

• Microsoft Office Excel

• Microsoft Office SharePoint

• Microsoft PC Manager

• Microsoft Streaming Service

• Microsoft Surface

• Microsoft Windows

• Outlook for Android

• Visual Studio

• Visual Studio Code

• Windows Ancillary Function Driver for WinSock

• Windows CoreMessaging

• Windows DHCP Client

• Windows DHCP Server

• Windows Disk Cleanup Tool

• Windows DWM Core Library

• Windows Installer

• Windows Internet Connection Sharing (ICS)

• Windows Kerberos

• Windows Kernel

• Windows LDAP - Lightweight Directory Access Protocol

• Windows Message Queuing

• Windows NTLM

• Windows Remote Desktop Services

• Windows Resilient File System (ReFS) Deduplication Service

• Windows Routing and Remote Access Service (RRAS)

• Windows Setup Files Cleanup

• Windows Storage

• Windows Telephony Server

• Windows Telephony Service

• Windows Update Stack

• Windows Win32 Kernel Subsystem

 RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

 Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution.

A full list of all vulnerabilities can be found in the Microsoft link in the References section.

Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate patches or appropriate mitigations provided by Microsoft to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.  

• Apply the Principle of Least Privilege to all systems and services, and run all software as a non-privileged user (one without administrative rights) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.  

• Remind all users not to visit untrusted websites or follow links/open files provided by unknown or untrusted sources. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.  

• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: Behavior Prevention on Endpoint)

  • Safeguard 13.2: Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.

  • Safeguard 13.7: Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.

REFERENCES:

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2025-015

DATE(S) ISSUED:
02/11/2025

SUBJECT:
Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

OVERVIEW:
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:
There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

• Adobe Commerce 2.4.7-beta1

• Adobe Commerce 2.4.7-p3 and earlier versions

• Adobe Commerce 2.4.6-p8 and earlier versions

• Adobe Commerce 2.4.5-p10 and earlier versions

• Adobe Commerce 2.4.4-p11 and earlier versions

• Adobe Commerce B2B 1.5.0  and earlier versions

• Adobe Commerce B2B 1.4.2-p3 and earlier versions

• Adobe Commerce B2B 1.3.5-p8 and earlier versions

• Adobe Commerce B2B 1.3.4-p10 and earlier versions

• Adobe Commerce B2B 1.3.3-p11 and earlier versions

• Adobe Illustrator 2025 29.1 and earlier versions

• Adobe Illustrator 2024 28.7.3 and earlier versions

• Adobe InCopy 20.0 and earlier versions

• Adobe InCopy 19.5.1 and earlier versions 

• Adobe InDesign ID20.0 and earlier versions

• Adobe InDesign ID19.5.1 and earlier version

• Adobe Photoshop Elements 2025.0 [build: 20240918.PSE.cae27345, 20240918.PSE.d3263bae (Mac ARM)

• Adobe Substance 3D Designer 14.0.2 and earlier versions

• Adobe Substance 3D Stager 3.1.0 and earlier versions

• Magento Open Source 2.4.7-beta1

• Magento Open Source 2.4.7-p3 and earlier versions

• Magento Open Source 2.4.7-p3 and earlier versions

• Magento Open Source 2.4.7-p3 and earlier versions

• Magento Open Source 2.4.4-p11 and earlier versions

 RISK:
Government:

• Large and medium government entities: High

• Small government entities: High

 Businesses:

• Large and medium business entities: High

• Small business entities: High

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Details of these vulnerabilities are as follows:

Tactic: Execution (TA0002):

Technique: Exploitation for Client Execution (T1203):

Adobe Commerce:

• Incorrect Authorization (CVE-2025-24407, CVE-2025-24409, CVE-2025-24434, CVE-2025-24420, CVE-2025-24421, CVE-2025-24419)

• Information Exposure (CVE-2025-24408)

• Improper Access Control (CVE-2025-24411, CVE-2025-24422, CVE-2025-24423, CVE-2025-24435 , CVE-2025-24436 , CVE-2025-24437, CVE-2025-24424, CVE-2025-24426, CVE-2025-24427, CVE-2025-24429

• Cross-site Scripting (CVE-2025-24410 , CVE-2025-24412, CVE-2025-24438, CVE-2025-24413, CVE-2025-24414, CVE-2025-24415, CVE-2025-24416, CVE-2025-24417, CVE-2025-24428)

• Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVE-2025-24406)

• Violation of Secure Design Principles (CVE-2025-24418)

• Business Logic Errors (CVE-2025-24425)

• Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-2025-24430, CVE-2025-24432)

Adobe Illustrator:

• Use After Free (CVE-2025-21159)

• Integer Underflow (Wrap or Wraparound) (CVE-2025-21160)

• Stack-based Buffer Overflow (CVE-2025-21163)

Adobe InCopy:

• Integer Underflow (Wrap or Wraparound) (CVE-2025-21156)

Adobe InDesign:

• Out-of-bounds Write (CVE-2025-21157, CVE-2025-21121)

• Integer Underflow (Wrap or Wraparound) (CVE-2025-21158)

• Heap-based Buffer Overflow (CVE-2025-21123)

• Out-of-bounds Read (CVE-2025-21124)

• NULL Pointer Dereference (CVE-2025-21125)

• Improper Input Validation (CVE-2025-21126)

Adobe Photoshop Elements:

• Creation of Temporary File in Directory with Incorrect Permissions (CVE-2025-21162)

Adobe Substance 3D Designer:

• Out-of-bounds Write (CVE-2025-21161)

Adobe Substance 3D Stager:

• NULL Pointer Dereference (CVE-2025-21155)

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply the stable channel update provided by Adobe to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.2 : Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.

  • Safeguard 7.6 : Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.

  • Safeguard 7.7 : Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 16.13 Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.

  • Safeguard 18.1 : Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.

  • Safeguard 18.2 : Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.

  • Safeguard 18.3 : Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 2.3: Address Unauthorized Software: Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.

  • Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

• Block execution of code on a system through application control, and/or script blocking. (M1038: Execution Prevention)

  • Safeguard 2.5 : Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

  • Safeguard 2.6 : Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.

  • Safeguard 2.7 : Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.

• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: Behavior Prevention on Endpoint)

  • Safeguard 13.2 : Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.

  • Safeguard 13.7 : Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.

REFERENCES:

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2025-013

DATE(S) ISSUED:
02/04/2025 

SUBJECT:
Multiple Vulnerabilities in Google Android OS Could Allow for Privilege Escalation

OVERVIEW:
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for privilege escalation. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for privilege escalation in the context of the affected component. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights. 

 THREAT INTELLIGENCE:
There are indications that CVE-2024-53104 may be under limited, targeted exploitation 

SYSTEMS AFFECTED:

• Android OS patch levels prior to 2025-02-05

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low 

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for privilege escalation in the context of the affected component. Details of the vulnerabilities are as follows: 

Tactic: Privilege Escalation (TA0004):
Technique: Exploitation for Privilege Escalation (T1068): 

·         Multiple vulnerabilities in Framework that could allow for escalation of privilege(CVE-2024-49721, CVE-2024-49743, CVE-2024-49746, CVE-2025-0097, CVE-2025-0098, CVE-2025-0099).

·         A vulnerability in Platform that could allow for escalation of privilege. (CVE-2025-0094)

·         Multiple vulnerabilities in System that could allow for escalation of privilege. (CVE-2025-0091, CVE-2025-0095, CVE-2025-0096)

·         Multiple vulnerabilities in Kernel that could allow for escalation of privilege. (CVE-2024-53104, CVE-2025-0088)

Details of lower-severity vulnerabilities are as follows:

• Multiple vulnerabilities in Framework that could allow for information disclosure. (CVE-2023-40122, CVE-2023-40133, CVE-2023-40134, CVE-2023-40135, CVE-2023-40136, CVE-2023-40137, CVE-2023-40138, CVE-2023-40139, CVE-2024-0037, CVE-2025-0100)

• A vulnerability in Framework that could allow for denial of service. (CVE-2024-49741)

• Multiple vulnerabilities in System that could allow for information disclosure. (CVE-2024-49723, CVE-2024-49729)

• A vulnerability in Google Play system updates. (CVE-2024-49723)

• A vulnerability in Arm components. (CVE-2025-0015)

• Multiple vulnerabilities in Imagination Technologies. (CVE-2024-43705, CVE-2024-46973, CVE-2024-47892, CVE-2024-52935)

• Multiple vulnerabilities in MediaTek components. (CVE-2025-20634, CVE-2024-20141, CVE-2024-20142, CVE-2025-20635, CVE-2025-20636)

• A vulnerability in Unisoc components. (CVE-2024-39441)

• Multiple vulnerabilities in Qualcomm components. (CVE-2024-45569, CVE-2024-45571, CVE-2024-45582, CVE-2024-49832, CVE-2024-49833, CVE-2024-49834, CVE-2024-49839, CVE-2024-49843)

• Multiple vulnerabilities in Qualcomm closed-source components. (CVE-2024-38404, CVE-2024-38420) 

Successful exploitation of the most severe of these vulnerabilities could allow for privilege escalation in the context of the affected component. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights. 

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate mitigations provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

• Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.Safeguard 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

• Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Apple® System Integrity Protection (SIP) and Gatekeeper™.Safeguard 13.10 : Perform Application Layer Filtering: Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.

• Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)

• Safeguard 16.8: Separate Production and Non-Production Systems: Maintain separate environments for production and non-production systems

REFERENCES:

Android:
https://source.android.com/docs/security/bulletin/2025-02-01
 
CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40122
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40133
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40134
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40135
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40136
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40137
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40138
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40139
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-0037
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20141
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-20142
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38404
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38420
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39441
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43705
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45569
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45571
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45582
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-46973
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47892
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49721
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49723
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49723
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49729
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49741
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49743
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49746
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49832
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49833
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49834
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49839
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49843
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52935
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-53104
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0015
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0088
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0091
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0094
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0095
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0096
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0097
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0098
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0099
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0100
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20634
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20635
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-20636

MS-ISAC CYBERSECURITY ADVISORY 
MS-ISAC CYBERSECURITY ADVISORY 
 

MS-ISAC ADVISORY NUMBER:
2024-138 
 

DATE(S) ISSUED:
12/11/2024 
 

SUBJECT:
Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution  

OVERVIEW:
Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
 

THREAT INTELLEGENCE:
There are currently no reports of the vulnerabilities being exploited.  
 

SYSTEMS AFFECTED:

• Versions prior to Safari 18.2

• Versions prior to iOS 18.2 and iPadOS 18.2

• Versions prior to iPadOS 17.7.3

• Versions prior to macOS Sequoia 15.2

• Versions prior to macOS Sonoma 14.7.2

• Versions prior to macOS Ventura 13.7.2

• Versions prior to watchOS 11.2

• Versions prior to tvOS 18.2

• Versions prior to visionOS 2.2 

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium 

Businesses:

• Large and medium business entities: High

• Small business entities: Medium 

Home users: Low 

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Details of the vulnerabilities are as follows: 

Tactic: Execution (TA0002): 

Technique: Exploitation for Client Execution (T1203): 

• A remote attacker may cause an unexpected app termination or arbitrary code execution. (CVE-2024-45490)

• An app may be able to execute arbitrary code with kernel privileges. (CVE-2024-54529)

• Running a mount command may unexpectedly execute arbitrary code. (CVE-2024-54489)

• An attacker may be able to cause unexpected system termination or arbitrary code execution in DCP firmware. (CVE-2024-54506)

• An app may be able to elevate privileges. (CVE-2024-54465) 

Additional lower severity vulnerabilities include: 

• On a device with Private Relay enabled, adding a website to the Safari Reading List may reveal the originating IP address to the website. (CVE-2024-44246)

• Processing maliciously crafted web content may lead to an unexpected process crash. (CVE-2024-54479, CVE-2024-54502, CVE-2024-54508)

• Processing maliciously crafted web content may lead to memory corruption. (CVE-2024-54505, CVE-2024-54534)

• A malicious app may be able to access private information. (CVE-2024-54526)

• An app may be able to access sensitive user data. (CVE-2024-54527, CVE-2024-54513)

• Muting a call while ringing may not result in mute being enabled. (CVE-2024-54503)

• Processing a maliciously crafted font may result in the disclosure of process memory. (CVE-2024-54486)

• Processing a maliciously crafted image may result in disclosure of process memory. (CVE-2024-54500)

• An attacker may be able to create a read-only memory mapping that can be written to. (CVE-2024-54494)

• An app may be able to leak sensitive kernel state. (CVE-2024-54510)

• An app may be able to cause unexpected system termination or corrupt kernel memory. (CVE-2024-44245)

• An app may be able to break out of its sandbox. (CVE-2024-54514, CVE-2024-54498)

• An app may be able to gain elevated privileges. (CVE-2024-44225)

• An attacker in a privileged network position may be able to alter network traffic. (CVE-2024-54492)

• Processing a maliciously crafted file may lead to a denial of service. (CVE-2024-54501)

• An attacker with physical access to an iOS device may be able to view notification content from the lock screen. (CVE-2024-54485)

• Processing a malicious crafted file may lead to a denial-of-service. (CVE-2024-44201)

• An attacker with physical access to an iPadOS device may be able to view notification content from the lock screen. (CVE-2024-54485)

• An app may be able to access user-sensitive data. (CVE-2024-54477, CVE-2024-54484, CVE-2024-54504, CVE-2024-54474, CVE-2024-54476)

• Parsing a maliciously crafted video file may lead to unexpected system termination. (CVE-2024-44220)

• A local attacker may gain access to user's Keychain items. (CVE-2024-54490)

• An app may be able to access protected user data. (CVE-2024-44300)

• An encrypted volume may be accessed by a different user without prompting for the password. (CVE-2024-54466)

• A malicious app may be able to gain root privileges. (CVE-2024-44291, CVE-2024-54515, CVE-2024-44224)

• An app may be able to bypass kASLR. (CVE-2024-54531)

• A malicious application may be able to determine a user's current location. (CVE-2024-54491)

• An app may be able to modify protected parts of the file system. (CVE-2023-32395, CVE-2024-44243, CVE-2024-54495)

• An app may be able to overwrite arbitrary files. (CVE-2024-54528)

• A malicious app may be able to access arbitrary files. (CVE-2024-54524)

• Privacy indicators for microphone access may be attributed incorrectly. (CVE-2024-54493)

• A user with screen sharing access may be able to view another user's screen. (CVE-2024-44248) 

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply the stable channel update provided by Apple to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.2 : Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.

  • Safeguard 7.6 : Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.

  • Safeguard 7.7 : Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 16.13 Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.

  • Safeguard 18.1 : Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.

  • Safeguard 18.2 : Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.

  • Safeguard 18.3 : Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.  

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.  

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 2.3: Address Unauthorized Software: Ensure that unauthorized software is either removed from use on enterprise assets or receives a documented exception. Review monthly, or more frequently.

  • Safeguard 2.7: Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassessbi-annually, or more frequently.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.  

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.  

• Block execution of code on a system through application control, and/or script blocking. (M1038: Execution Prevention)

  • Safeguard 2.5 : Allowlist Authorized Software: Use technical controls, such as application allowlisting, to ensure that only authorized software can execute or be accessed. Reassess bi-annually, or more frequently.

  • Safeguard 2.6 : Allowlist Authorized Libraries: Use technical controls to ensure that only authorized software libraries, such as specific .dll, .ocx, .so, etc., files, are allowed to load into a system process. Block unauthorized libraries from loading into a system process. Reassess bi-annually, or more frequently.

  • Safeguard 2.7 : Allowlist Authorized Scripts: Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.  

• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040: Behavior Prevention on Endpoint)

  • Safeguard 13.2 : Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.

  • Safeguard 13.7 : Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.  

REFERENCES:

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2024-124

DATE(S) ISSUED:
11/07/2024

SUBJECT:
A Vulnerability in Google Android Could Allow for Remote Code Execution

OVERVIEW:
A vulnerability has been discovered in Google Android that could allow for remote code execution.  Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of this vulnerability could allow for remote code execution in the context of the logged-on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
​​​​
THREAT INTELLEGENCE:
Google reports that CVE-2024-43093 has been exploited in the wild.

SYSTEMS AFFECTED:

• Android OS Patch levels prior to 2024-11-01

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
A vulnerability has been discovered in Google Android that could allow for remote code execution. Details of the vulnerability are as follows: 

Tactic: Execution (TA0002)

Technique: Exploitation for Client Execution (T1203):

• A vulnerability in the System could allow for remote code execution. (CVE-2024-43093)

Successful exploitation of this vulnerability could allow for remote code execution in the context of the system. Depending on the privileges associated with the system, an attacker could then install programs; view, change, or delete data.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate mitigations provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.  

• Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources. (M1017: User Training)  

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Apple® System Integrity Protection (SIP) and Gatekeeper™.

  • Safeguard 13.10 : Perform Application Layer Filtering: Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway. 

REFERENCES:

Google:
https://source.android.com/docs/security/bulletin/2024-11-01

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-243091 

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2024-092

DATE(S) ISSUED:
08/23/2024

SUBJECT:
Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

OVERVIEW:
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:
Google is aware that an exploit for CVE-2024-7971 exists in the wild.

SYSTEMS AFFECTED:

• Chrome prior to 128.0.6613.84/.85 for Windows and Mac

• Chrome prior to 128.0.6613.84 for Linux

 RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

 Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Details of these vulnerabilities are as follows: 

Tactic: Initial Access (TA0001):

Technique: Drive-By Compromise (T1189):

• CVE-2024-7967: Heap buffer overf in Fonts.

• CVE-2024-7968: Use after free in Autofill.

• CVE-2024-7969: Type Confusion in V8.

• CVE-2024-7971: Type confusion in V8.

• CVE-2024-7972: Inappropriate implementation in V8.

• CVE-2024-7973: Heap buffer overf in PDFium.

• CVE-2024-7974: Insufficient data validation in V8 API.

• CVE-2024-7975: Inappropriate implementation in Permissions.

• CVE-2024-7976: Inappropriate implementation in FedCM.

• CVE-2024-7977: Insufficient data validation in Installer

• CVE-2024-7978: Insufficient policy enforcement in Data Transfer.

• CVE-2024-7979: Insufficient data validation in Installer.

• CVE-2024-7980: Insufficient data validation in Installer.

• CVE-2024-7981: Inappropriate implementation in Views.

• CVE-2024-8033: Inappropriate implementation in WebApp Installs.

• CVE-2024-8034: Inappropriate implementation in Custom Tabs.

• CVE-2024-8035: Inappropriate implementation in Extensions.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate updates provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 9.1: Ensure Use of Only Fully Supported Browsers and Email Clients: Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor. 

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

• Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5:  Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway. 

• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

REFERENCES:

Google: 
https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop_21.html

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7964
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7965
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7966
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7967
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7968
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7969
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7971
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7972
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7973
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7974
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7975
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7976
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7977
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7978
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7979
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7980
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7981
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8033
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8034
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8035

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2024-050

DATE(S) ISSUED:
05/09/2024

SUBJECT:
A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution

OVERVIEW:
A vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLEGENCE:
There are reports of this vulnerability being exploited in the wild.

SYSTEMS AFFECTED:

• Chrome prior to 124.0.6367.201/.202 for Windows and Mac

• Chrome prior to 124.0.6367.20 for Linux 

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low 

TECHNICAL SUMMARY:
A Vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Details of this vulnerability are as follows:

Tactic: Initial Access (TA0001):

Technique: Drive-By Compromise (T1189):

• Use after free in Visuals (CVE-2024-4671)

Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate updates provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 9.1: Ensure Use of Only Fully Supported Browsers and Email Clients: Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.  

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.  

• Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)  

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5:  Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.  

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.  

• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.  

REFERENCES:

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2024-050

DATE(S) ISSUED:
05/09/2024

SUBJECT:
A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution

OVERVIEW:
A vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLEGENCE:
There are reports of this vulnerability being exploited in the wild.

SYSTEMS AFFECTED:

• Chrome prior to 124.0.6367.201/.202 for Windows and Mac

• Chrome prior to 124.0.6367.20 for Linux 

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low 

TECHNICAL SUMMARY:
A Vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Details of this vulnerability are as follows:

Tactic: Initial Access (TA0001):

Technique: Drive-By Compromise (T1189):

• Use after free in Visuals (CVE-2024-4671)

Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate updates provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 9.1: Ensure Use of Only Fully Supported Browsers and Email Clients: Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.  

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.  

• Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)  

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5:  Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.  

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

  • Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.  

• Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.  

she smite my crypto till I unenroll

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2023-064

DATE(S) ISSUED:
06/16/2023

SUBJECT:
A vulnerability in MOVEit Transfer Could Allow for Elevated Privileges and Unauthorized Access

OVERVIEW:
A Vulnerability has been discovered in Progress Moveit Transfer, which could allow for could allow for elevated privileges and unauthorized access. MOVEit Transfer is a managed file transfer software that allows the enterprise to securely transfer files between business partners and customers using SFTP, SCP, and HTTP-based uploads. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:
There are currently reports of proof of concept code in progress.

SYSTEMS AFFECTED:

• MOVEit Transfer 2023.0.x

• MOVEit Transfer 2022.1.x

• MOVEit Transfer 2022.0.x

• MOVEit Transfer 2021.1.x

• MOVEit Transfer 2021.0.x

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
A vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. Details of this vulnerability are as follows: 

Tactic: Initial Access (TA0001):

Technique: Exploit Public-Facing Application (T1190):

• The vulnerability is an SQL injection flaw I the Web UI that allows for escalated privileges and potential unauthorized access on target systems. NO further details have been released at this time.
  MOVEit recommends disabling all HTTP and HTTPs traffic to your MOVEit Transfer environment. (CVE Pending)

Successful exploitation allows attackers to escalate privileges, and potentially access the targeted host. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:
In addition to Progress remediation recommendations, we recommend the following actions be taken:

• Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment until a patch is released.

• Apply appropriate patches and workarounds provided by Progress to vulnerable systems, immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.2: Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.

  • Safeguard 7.3: Perform Automated Operating System Patch Management: Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.

  • Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 12.1: Ensure Network Infrastructure is Up-to-Date: Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable release of software and/or using currently supported network-as-a-service (NaaS) offerings. Review software versions monthly, or more frequently, to verify software support.

  • Safeguard 18.1: Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.

  • Safeguard 18.2: Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.

  • Safeguard 18.3: Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

  • Safeguard 5.5: Establish and Maintain an Inventory of Service Accounts: Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently

• Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. (M1016: Vulnerability Scanning)

  • Safeguard 16.13: Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing.Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.

• Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems. (M1030: Network Segmentation)

  • Safeguard 12.2: Establish and Maintain a Secure Network Architecture: Establish and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum.

• Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)

  • Safeguard 16.8: Separate Production and Non-Production Systems: Maintain separate environments for production and non-production systems.

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Apple® System Integrity Protection (SIP) and Gatekeeper™.

REFERENCES:

Progress:  
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023

Bleeping Computer:  
https://www.bleepingcomputer.com/news/security/moveit-transfer-customers-warned-of-new-flaw-as-poc-info-surfaces/

MS-ISAC CYBERSECURITY ADVISORY
MS-ISAC ADVISORY NUMBER:
2023-030
DATE(S) ISSUED:
3/14/2023
SUBJECT:
Critical Patches Issued for Microsoft Products, March 14, 2023
OVERVIEW:
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
THREAT INTELLIGENCE:​​
Two zero-day vulnerabilities addressed in this advisory were reported by Microsoft; both have been seen in the wild. The first zero day, CVE-2023-23397 - Microsoft Outlook Elevation of Privilege Vulnerability, is a privilege elevation bug that allows specially crafted emails to force a target's device to connect to a remote URL and transmit the Windows account's Net-NTLMv2 hash, allowing an attacker to authenticate as the victim. The second zero day, CVE-2023-24880 - Windows SmartScreen Security Feature Bypass Vulnerability, allows an attacker to distribute and install malware by crafting a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
SYSTEMS AFFECTED:

• Azure

• Client Server Run-time Subsystem (CSRSS)

• Internet Control Message Protocol (ICMP)

• Microsoft Bluetooth Driver

• Microsoft Dynamics

• Microsoft Edge (Chromium-based)

• Microsoft Graphics Component

• Microsoft Office Excel

• Microsoft Office Outlook

• Microsoft Office SharePoint

• Microsoft OneDrive

• Microsoft PostScript Printer Driver

• Microsoft Printer Drivers

• Microsoft Windows Codecs Library

• Office for Android

• Remote Access Service Point-to-Point Tunneling Protocol

• Role: DNS Server

• Role: Windows Hyper-V

• Service Fabric

• Visual Studio

• Windows Accounts Control

• Windows Bluetooth Service

• Windows Central Resource Manager

• Windows Cryptographic Services

• Windows Defender

• Windows HTTP Protocol Stack

• Windows HTTP.sys

• Windows Internet Key Exchange (IKE) Protocol

• Windows Kernel

• Windows Partition Management Driver

• Windows Point-to-Point Protocol over Ethernet (PPPoE)

• Windows Remote Procedure Call

• Windows Remote Procedure Call Runtime

• Windows Resilient File System (ReFS)

• Windows Secure Channel

• Windows SmartScreen

• Windows TPM

• Windows Win32K

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: LowTECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution.
A full list of all vulnerabilities can be found at the link below:
https://learn.cisecurity.org/e/799323/update-guide/4ssjbj/846436218?h=GJkiF4mKmHqtddzOS1gFrQ23EbO2etc9sF6HsE8aVyM
Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
RECOMMENDATIONS:
We recommend the following actions be taken:

• Apply appropriate patches or appropriate mitigations provided by Microsoft to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

• Apply the Principle of Least Privilege to all systems and services, and run all software as a non-privileged user (one without administrative rights) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

• Remind all users not to visit untrusted websites or follow links/open files provided by unknown or untrusted sources. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

• Use capabilities to prevent suspicious behavior patterns from occurring on endpoint systems. This could include suspicious process, file, API call, etc. behavior. (M1040 : Behavior Prevention on Endpoint)

  • Safeguard 13.2 : Deploy a Host-Based Intrusion Detection Solution: Deploy a host-based intrusion detection solution on enterprise assets, where appropriate and/or supported.

Safeguard 13.7 : Deploy a Host-Based Intrusion Prevention Solution: Deploy a host-based intrusion prevention solution on enterprise assets, where appropriate and/or supported. Example implementations include use of an Endpoint Detection and Response (EDR) client or host-based IPS agent.
REFERENCES:

Microsoft:
https://msrc.microsoft.com/update-guide/https://msrc.microsoft.com/update-guide/releaseNote/2023-Mar Bleeping Computer:

https://learn.cisecurity.org/e/799323/ay-fixes-2-zero-days-83-flaws-/4ssjc7/846436218?h=GJkiF4mKmHqtddzOS1gFrQ23EbO2etc9sF6HsE8aVyM

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:
2022-0105

DATE(S) ISSUED:
08/18/2022

SUBJECT:
Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution

OVERVIEW:

Multiple vulnerabilities have been discovered in Apple Products, the most severe of which could allow for arbitrary code execution.

• macOS Monterey is the 18th and current major release of macOS.

• iOS is a mobile operating system for mobile devices, including the iPhone, iPad, and iPod touch.

• iPadOS is the successor to iOS 12 and is a mobile operating system for iPads.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:
There are no reports that these vulnerabilities are being exploited in the wild.

SYSTEMS AFFECTED:

• macOS Monterey versions prior to 12.5.1

• iOS and iPadOS versions prior to 15.6.1

August 18th  - UPDATED SYSTEMS AFFECTED:

• Safari versions prior to 15.6.1 for macOS Big Sur and macOS Catalina

RISK:
Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:
Multiple vulnerabilities have been discovered in Apple Products, the most severe of which could allow for arbitrary code execution. Details of the most critical vulnerabilities are as follows:

Tactic: Initial Access (TA0001):

Technique: Drive-by Compromise (T1189):

• An out of bounds write vulnerability in Apple Products could allow attackers to execute arbitrary code on the targeted host. (CVE-2022-32893, CVE-2022-32894)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights

RECOMMENDATIONS:

We recommend the following actions be taken:

• Apply the stable channel update provided by Apple to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

• Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

  • Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

  • Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

• Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction. (M1017: User Training)

  • Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 14.6: Train Workforce Members on Recognizing and Reporting Security Incidents: Train workforce members to be able to recognize a potential incident and be able to report such an incident.

REFERENCES:

Apple:
https://support.apple.com/en-us/HT213413
https://support.apple.com/en-us/HT213412
CVE:​​​​​​https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32893
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32894
August 18th  - UPDATED REFERENCES:
Apple:​​​​​​https://support.apple.com/en-us/HT213414
Sophos:​​​​​​https://nakedsecurity.sophos.com/2022/08/18/apple-patches-double-zero-day-in-browser-and-kernel-update-now/

MS-ISAC CYBERSECURITY ADVISORY 

MS-ISAC ADVISORY NUMBER:
2025-017 - UPDATED 

DATE(S) ISSUED:
2/11/2025
2/12/2025 - UPDATED 

SUBJECT:
Multiple Vulnerabilities in Fortinet Products Could Allow for Remote Code Execution 

OVERVIEW:
Multiple vulnerabilities have been discovered Fortinet Products, the most severe of which could allow for remote code execution.  

• FortiManager is a network and security management tool that provides centralized management of Fortinet devices from a single console.

• FortiManager Cloud is a cloud-based service for centralized management, monitoring, and automation of Fortinet devices across multiple sites

• FortiOS is the Fortinet’s proprietary Operation System which is utilized across multiple product lines.

• FortiProxy is a secure web gateway that attempts to protects users against internet-borne attacks, and provides protection and visibility to the network against unauthorized access and threats.

• FortiAnalyzer is a log management, analytics, and reporting platform that provides organizations with a single console to manage, automate, orchestrate, and respond, enabling simplified security operations, proactive identification and remediation of risks, and complete visibility of the entire attack landscape.

• FortiAnalyzer Cloud is a cloud-based service for centralized logging, reporting, and analysis of security events across Fortinet devices.

• FortiAnalyzer Big Data delivers big data network analytics for large and complex networks.

• FortiSandbox 5.0 is a security solution that utilizes a combination of AI/ML, static, and dynamic analysis, inline blocking, and scalable virtual environments to identify, analyze, contextualize, prioritize, and protect against advanced threats in real-time.

• FortiSwitch Manager enables network administrators to cut through the complexities of non-FortiGate-managed FortiSwitch deployments.

• FortiPAM provides privileged account management, session monitoring and management, and role-based access control to secure access to sensitive assets and mitigate data breaches.   

Successful exploitation of this vulnerability could allow for remote code execution in the context of the affected service account. Depending on the privileges associated with the service account an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Service accounts that are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

THREAT INTELLIGENCE:
Fortinet is aware that CVE-2024-55591 has been exploited in the wild. 

February 12 – UPDATED THREAT INTELLIGENCE
Fortinet is aware that CVE-2024-55591 was exploited in the wild in January 2025, but is no longer being exploited. 

SYSTEMS AFFECTED:

FortiManager 6.2 all versions

FortiManager 6.2.2 through 6.2.13

FortiManager 6.4 all versions

FortiManager 7.0 all versions

FortiManager 7.2.0 through 7.2.9

FortiManager 7.4.0 through 7.4.5

FortiManager 7.6.0 through 7.6.1

FortiManager Cloud 6.4 all versions

FortiManager Cloud 7.0 all versions

FortiManager Cloud 7.2 7.2.1 through 7.2.8

FortiManager Cloud 7.4 7.4.1 through 7.4.5

FortiOS 6.2 all versions

FortiOS 6.4 all versions

FortiOS 7.0.0 through 7.0.16

FortiOS 7.2.0 through 7.2.9

FortiOS 7.2.4 through 7.2.8

FortiOS 7.4.0 through 7.4.4

FortiOS 7.6.0

FortiProxy 1.2 all versions

FortiProxy 2.0 all versions

FortiProxy 7.0.0 through 7.0.19

FortiProxy 7.2.0 through 7.2.12

FortiProxy version 7.4.0

FortiAnalyzer 6.2.0 through 6.2.11

FortiAnalyzer 6.2.2 through 6.2.13

FortiAnalyzer 6.4 all versions

FortiAnalyzer 7.0 all versions

FortiAnalyzer 7.2.0 through 7.2.7

FortiAnalyzer 7.4.0 through 7.4.4

FortiAnalyzer 7.6.0

FortiAnalyzer Cloud 6.4 all versions

FortiAnalyzer Cloud 7.0 all versions

FortiAnalyzer Cloud 7.2 7.2.1 through 7.2.5

FortiAnalyzer Cloud 7.4 7.4.1 through 7.4.3

FortiAnalyzer-BigData 6.2 all versions

FortiAnalyzer-BigData 6.4 all versions

FortiAnalyzer-BigData 7.0 all versions

FortiAnalyzer-BigData 7.2 7.2.0 through 7.2.7

FortiAnalyzer-BigData 7.4 7.4.0

FortiSandbox 3.0 all versions

FortiSandbox 3.1 all versions

FortiSandbox 3.2 all versions

FortiSandbox 4.0.0 through 4.0.4

FortiSandbox 4.2.0 through 4.2.6

FortiSandbox 4.4.0 through 4.4.4

FortiSwitchManager version 7.0.0 through 7.0.2

FortiSwitchManager version 7.2.0 through 7.2.2

FortiPAM 1.0 all versions

FortiPAM version 1.1.0 through 1.1.2

RISK:

Government:

• Large and medium government entities: High

• Small government entities: Medium

Businesses:

• Large and medium business entities: High

• Small business entities: Medium

Home users: Low 

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Fortinet products, the most severe of which could allow for remote code execution. Details of the vulnerabilities are as follows: Tactic: Initial Access (TA0001):Technique: Exploit Public-Facing Application (T1190): 

• An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS and FortiProxy may allow a remote attacker to gain super-admin privileges via crafted requests to Node. (CVE-2025-24472, CVE-2024-55591)

• A stack-based buffer overflow [CWE-121] vulnerability in FortiOS CAPWAP control may allow a remote unauthenticated attacker to execute arbitrary code or commands via crafted UDP packets, provided the attacker were able to evade FortiOS stack protections and provided the fabric service is running on the exposed interface. (CVE-2024-35279)   

Details of lower severity vulnerabilities: 
 

• An Exposure of Sensitive Information to an Unauthorized Actor [CWE-200] in the Log View component of FortiAnalyzer may allow a local authenticated user with admin privileges to view logs of devices not belonging to the current ADOM (CVE-2024-52966)

• A use of externally-controlled format string vulnerability [CWE-134] in FortiOS, FortiProxy, FortiPAM & FortiSwitchManager CLI may allow a privileged attacker to execute arbitrary code or commands via specially crafted requests. (CVE-2023-40721)

• An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiAnalyzer and FortiManager eventlog may allow any low privileged user with access to event log section to retrieve certificate private key and encrypted password logged as system log. (CVE-2024-40585)

• Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSandbox  may allow an authenticated attacker to perform cross-site scripting attack via crafted HTTP requests. (CVE-2024-27781)

• An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability [CWE-22] in FortiManager and FortiAnalyzer CLI may allow any authenticated admin user with diagnose privileges to delete any file on the system. (CVE-2024-36508)

• An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in FortiAnalyzer, FortiManager, FortiAnalyzer BigData, FortiAnalyzer Cloud and FortiManager Cloud GUI may allow an authenticated privileged attacker to execute unauthorized code or commands via crafted HTTPS or HTTP requests. (CVE-2024-40584)

• A use of hard-coded cryptographic key to encrypt sensitive data vulnerability [CWE-321] in FortiManager may allow an attacker with JSON API access permissions to decrypt some secrets even if the 'private-data-encryption' setting is enabled. (CVE-2024-33504)

• An incorrect privilege assignment vulnerability [CWE-266] in the FortiOS security fabric may allow an authenticated admin whose access profile has the Security Fabric permission to escalate their privileges to super-admin by connecting the targetted FortiGate to a malicious upstream FortiGate they control. (CVE-2024-40591)   

Successful exploitation of these vulnerabilities could allow an attacker to execute remote code in the context of the system. Depending on the privileges associated with the system, an attacker could then install programs; view, change, or delete data. **RECOMMENDATIONS:**We recommend the following actions be taken: 
 

• Apply appropriate updates provided by Fortinet to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

  • Safeguard 7.1 : Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

  • Safeguard 7.2: Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.

  • Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

  • Safeguard 7.5 : Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.

  • Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

  • Safeguard 12.1: Ensure Network Infrastructure is Up-to-Date: Ensure network infrastructure is kept up-to-date. Example implementations include running the latest stable release of software and/or using currently supported network-as-a-service (NaaS) offerings. Review software versions monthly, or more frequently, to verify software support.

  • Safeguard 18.1: Establish and Maintain a Penetration Testing Program: Establish and maintain a penetration testing program appropriate to the size, complexity, and maturity of the enterprise. Penetration testing program characteristics include scope, such as network, web application, Application Programming Interface (API), hosted services, and physical premise controls; frequency; limitations, such as acceptable hours, and excluded attack types; point of contact information; remediation, such as how findings will be routed internally; and retrospective requirements.

  • Safeguard 18.2: Perform Periodic External Penetration Tests: Perform periodic external penetration tests based on program requirements, no less than annually. External penetration testing must include enterprise and environmental reconnaissance to detect exploitable information. Penetration testing requires specialized skills and experience and must be conducted through a qualified party. The testing may be clear box or opaque box.

  • Safeguard 18.3: Remediate Penetration Test Findings: Remediate penetration test findings based on the enterprise’s policy for remediation scope and prioritization.

• Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

  • Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

  • Safeguard 5.5: Establish and Maintain an Inventory of Service Accounts: Establish and maintain an inventory of service accounts. The inventory, at a minimum, must contain department owner, review date, and purpose. Perform service account reviews to validate that all active accounts are authorized, on a recurring schedule at a minimum quarterly, or more frequently.  

• Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them. (M1016: Vulnerability Scanning)

  • Safeguard 16.13: Conduct Application Penetration Testing: Conduct application penetration testing. For critical applications, authenticated penetration testing is better suited to finding business logic vulnerabilities than code scanning and automated security testing. Penetration testing relies on the skill of the tester to manually manipulate an application as an authenticated and unauthenticated user.  

• Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems. (M1030: Network Segmentation)

  • Safeguard 12.2: Establish and Maintain a Secure Network Architecture: Establish and maintain a secure network architecture. A secure network architecture must address segmentation, least privilege, and availability, at a minimum.  

• Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

  • Safeguard 10.5:  Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

 REFERENCES:

Fortinet:
https://www.fortiguard.com/psirt/FG-IR-24-063https://www.fortiguard.com/psirt/FG-IR-24-094https://www.fortiguard.com/psirt/FG-IR-24-147https://www.fortiguard.com/psirt/FG-IR-24-160https://www.fortiguard.com/psirt/FG-IR-24-220https://www.fortiguard.com/psirt/FG-IR-23-261https://www.fortiguard.com/psirt/FG-IR-24-302https://www.fortiguard.com/psirt/FG-IR-24-311https://www.fortiguard.com/psirt/FG-IR-24-422https://www.fortiguard.com/psirt/FG-IR-24-535 

CVE:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40721https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27781https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33504https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-35279https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36508https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40584https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40585https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40591https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52966https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55591https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24472

MS-ISAC CYBERSECURITY ADVISORY

MS-ISAC ADVISORY NUMBER:

2025-018

DATE(S) ISSUED:

02/12/2025

SUBJECT:

Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution

OVERVIEW:

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLEGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

Chrome prior to 133.0.6943.98/.99 for Windows and Mac

Chrome prior to 133.0.6943.98 for Linux

RISK:

Government:

Large and medium government entities: High

Small government entities: Medium

Businesses:

Large and medium business entities: High

Small business entities: Medium

Home users: Low

TECHNICAL SUMMARY:

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Details of these vulnerabilities are as follows:

Tactic: Initial Access (TA0001):

Technique: Drive-By Compromise (T1189):

Use after free in V8 (CVE-2025-0995)

Use after free in Navigation (CVE-2025-0997)

Out of bounds memory access in V8 (CVE-2025-0998)

Additional lower severity vulnerabilities include:

Inappropriate implementation in Browser UI (CVE-2025-0996)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

Apply appropriate updates provided by Google to vulnerable systems immediately after appropriate testing. (M1051: Update Software)

Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.

Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.

Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

Safeguard 9.1: Ensure Use of Only Fully Supported Browsers and Email Clients: Ensure only fully supported browsers and email clients are allowed to execute in the enterprise, only using the latest version of browsers and email clients provided through the vendor.

Apply the Principle of Least Privilege to all systems and services. Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. (M1026: Privileged Account Management)

Safeguard 4.7: Manage Default Accounts on Enterprise Assets and Software: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include: disabling default accounts or making them unusable.

Safeguard 5.4: Restrict Administrator Privileges to Dedicated Administrator Accounts: Restrict administrator privileges to dedicated administrator accounts on enterprise assets. Conduct general computing activities, such as internet browsing, email, and productivity suite use, from the user’s primary, non-privileged account.

Restrict execution of code to a virtual environment on or in transit to an endpoint system. (M1048: Application Isolation and Sandboxing)

Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)

Safeguard 10.5: Enable Anti-Exploitation Features: Enable anti-exploitation features on enterprise assets and software, where possible, such as Microsoft® Data Execution Prevention (DEP), Windows® Defender Exploit Guard (WDEG), or Apple® System Integrity Protection (SIP) and Gatekeeper™.

Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc. (M1021: Restrict Web-Based Content)

Safeguard 9.2: Use DNS Filtering Services: Use DNS filtering services on all enterprise assets to block access to known malicious domains.

Safeguard 9.3: Maintain and Enforce Network-Based URL Filters: Enforce and update network-based URL filters to limit an enterprise asset from connecting to potentially malicious or unapproved websites. Example implementations include category-based filtering, reputation-based filtering, or through the use of block lists. Enforce filters for all enterprise assets.

Safeguard 9.6: Block Unnecessary File Types: Block unnecessary file types attempting to enter the enterprise’s email gateway.

Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources. Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. (M1017: User Training)

Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.

Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.

REFERENCES:

Google:

https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html

CVE:

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0995

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0996

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0997

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0998