CCTR.11.March.24
Zeek, TeamCity, VMware, APT
Last updated
Zeek, TeamCity, VMware, APT
Last updated
The Ethercat Zeek Plugin, a component of the Industrial Control Systems Network Protocol Parsers (ICSNPP) utilised in the opensource network security monitoring tool Zeek, has been identified with multiple vulnerabilities, namely CVE-2023-7244, CVE-2023-7243, and CVE-2023-7242. These vulnerabilities pose a risk of potential unauthorized access to ICS networks. It's noteworthy that this plugin is automatically integrated with various popular security software, such as Security Onion. Consequently, these vulnerabilities have the potential to impact not only ICS environments but also extend their reach to broader IT environments as well. CI-ISAC Australia CISA The recently disclosed JetBrains TeamCity vulnerability, CVE-2024-27198 (CVSS 9.8), has been added to the CISA Known Exploited Vulnerabilities (KVE) catalogue due to observed exploitation shortly after disclosure. Patches have been released for two authentication bypass vulnerabilities affecting TeamCity, with the critical flaw allowing a remote, unauthenticated attacker to take complete control of a vulnerable server, posing a significant risk for launching supply chain attacks. Ref VMware has released critical patches to address sandbox escape vulnerabilities in its ESXi, Workstation, Fusion, and Cloud Foundation products. Sandbox escape vulnerabilities, which are among my favourite types, are far too rare to come by. These could allow malicious actors to break out of virtual machine sandboxes and execute code on host systems. Organisations are urged to apply the patches promptly to mitigate the risk of exploitation and safeguard virtualised environments. Ref Microsoft has provided an update on the activities of Midnight Blizzard (NOBELIUM), a Russian state-sponsored hacker group targeting Microsoft. The group gained access to source code repositories and internal systems, raising concerns about potential targeted attacks. As Rob Dartnall - CCTIM pointed out, there is worry that they might use the acquired data to identify vulnerabilities and enhance their capabilities, posing a significant risk to re-target Microsoft and potentially targeting its customers with the same information. Ref The North Korean APT group Kimsuky is exploiting recent disclosed ScreenConnect vulnerabilities CVE-2024-1708 and CVE-2024-1709, to infect targets with a new malware variant dubbed Toddler Shark which designed for longterm espionage and intelligence gathering. Ref
