Riasztások

SANS · 2019. július 20.

Re-evaluating Network Security - It is Increasingly More Complex, (Sat, Jul 20th)

I saw an interesting report [1] this week released last month (June 2019) by the Enterprise Strategy Group (ESG) about the increase complexity dealing with network security. The report highlights these three things:

  • Increase in the past 2 years where network security is more complex and challenging (83% of those survey agree)
  • Business difficulty keeping up with network security (i.e. wrong network security, process and controls)
  • Looking for new types of network security that includes consolidation and architecture featuring centralizing management

The report identified three main factors related to the increase in network security complexity. The attack surface and the workload are both growing and the threats and vulnerabilities are more complex to identify and deal with. The security team has to keep up with more devices that add complexity to a network (IoT, tablets, phones, laptops, cloud computing, etc) that are now widely integrated to the enterprise. Complex security events can lead to short or extended network outages, application or network availability, loss of proprietary data and/or productivity.

In The Need for Change section, the report highlight the following priorities: "[...] the biggest factors driving network security include preventing/detecting malware threats (47%), regulatory compliance (42%), support for cloud computing initiatives (38%), and the need for network security to be more scalable to support dynamic business processes and new business initiatives (34%)."[1]

What keeps you up at night? Are your priorities similar to those identified in this report?

[1] https://www.cisco.com/c/dam/en/us/products/collateral/security/defense-orchestrator/esg-research-insights-report.pdf

-----------
Guy Bruneau IPSS Inc.
My Handler Page
Twitter: GuyBruneau
gbruneau at isc dot sans dot edu

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Linux security Advisories · 2019. július 20.

Debian LTS: DLA-1858-1: squid3 security update

Squid, a high-performance proxy caching server for web clients, has been found vulnerable to denial of service attacks associated with HTTP authentication header processing.
Linux security Advisories · 2019. július 20.

Debian LTS: DLA-1857-1: nss security update

Vulnerabilities have been discovered in nss, the Mozilla Network Security Service library.
Linux security Advisories · 2019. július 20.

Debian: DSA-4484-1: linux security update

Jann Horn discovered that the ptrace subsystem in the Linux kernel mishandles the management of the credentials of a process that wants to create a ptrace relationship, allowing a local user to obtain root privileges under certain scenarios.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1752-1: moderate: libqb

An update that fixes one vulnerability is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1750-1: important: dbus-1

An update that fixes one vulnerability is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1754-1: moderate: python-requests

An update that fixes one vulnerability is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1755-1: important: samba

An update that solves one vulnerability and has four fixes is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1749-1: moderate: glib2

An update that fixes one vulnerability is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1758-1: important: MozillaFirefox

An update that fixes four vulnerabilities is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1751-1: fence-agents

An update that solves one vulnerability and has one errata is now available.
Linux security Advisories · 2019. július 20.

openSUSE: 2019:1753-1: important: libvirt

An update that fixes four vulnerabilities is now available.
NVD: all CVE · 2019. július 20.

CVE-2018-17210

An issue was discovered in PrinterOn Central Print Services (CPS) through 4.1.4. The core components that create and launch a print job do not perform complete verification of the session cookie that is supplied to them. As a result, an attacker with guest/pseudo-guest level permissions can bypass the session checks (that would otherwise logout a low-privileged user) by calling the core print job components directly via crafted HTTP GET and POST requests.
NVD: all CVE · 2019. július 20.

CVE-2019-12934

An issue was discovered in the wp-code-highlightjs plugin through 0.6.2 for WordPress. wp-admin/options-general.php?page=wp-code-highlight-js allows CSRF, as demonstrated by an XSS payload in the hljs_additional_css parameter.
NVD: all CVE · 2019. július 20.

CVE-2019-9229

An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A to F7.20A.251. An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can authenticate with the default 1234 password that cannot be changed, and can execute malicious and unauthorized actions.
Linux security Advisories · 2019. július 20.

Fedora 29: samba FEDORA-2019-8966706e33

Update to Samba 4.9.11 ---- Update to Samba 4.9.9 Security fixes for CVE-2019-12435
Linux security Advisories · 2019. július 20.

Fedora 29: libldb FEDORA-2019-8966706e33

Update to Samba 4.9.11 ---- Update to Samba 4.9.9 Security fixes for CVE-2019-12435
NVD: all CVE · 2019. július 20.

CVE-2019-12815

An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to CVE-2015-3306.
NVD: all CVE · 2019. július 20.

CVE-2019-13569

A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
NVD: all CVE · 2019. július 20.

CVE-2019-9228

** DISPUTED ** An issue was discovered on AudioCodes Mediant 500L-MSBR, 500-MBSR, M800B-MSBR and 800C-MSBR devices with firmware versions F7.20A at least to 7.20A.252.062. The (1) management SSH and (2) management TELNET features allow remote attackers to cause a denial of service (connection slot exhaustion) via 5 unauthenticated connection attempts, because the maximum number of unauthenticated clients that can be configured is 5. NOTE: the vendor's position is that this is a "design choice."