Active Exploitation of VMware and Kemp LoadMaster Vulnerabilities

December 1, 2024December 1, 2024

Active Exploitation of Security Flaws in Progress Kemp LoadMaster and VMware vCenter Server: What You Need to Know

Recent reports indicate that critical security vulnerabilities affecting Progress Kemp LoadMaster and VMware vCenter Server are now being actively exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-1212, a high-severity vulnerability in Progress Kemp LoadMaster, to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability, with a CVSS score of 10.0, allows unauthenticated remote attackers to execute arbitrary commands on affected systems, posing a significant risk to organizations.

Understanding the CVE-2024-1212 Vulnerability

Progress Kemp LoadMaster is susceptible to an OS command injection vulnerability that enables attackers to gain unauthorized access through the LoadMaster management interface. This flaw was initially addressed by Progress Software in February 2024. According to Rhino Security Labs, the successful exploitation of CVE-2024-1212 can lead to full administrative access, allowing attackers to execute commands on the load balancer.

VMware vCenter Server Vulnerabilities Under Attack

In addition to the issues with Progress Kemp LoadMaster, CISA has also raised alarms regarding two critical vulnerabilities in VMware vCenter Server: CVE-2024-38812 (CVSS score: 9.8) and CVE-2024-38813 (CVSS score: 7.5). These vulnerabilities were showcased at the Matrix Cup cybersecurity competition in June and were resolved in September 2024. However, VMware issued a second fix for CVE-2024-38812 last month, stating that the initial patches did not fully address the issues.

CVE-2024-38812: A heap-overflow vulnerability that could allow a network-accessible attacker to execute remote code.
CVE-2024-38813: A privilege escalation vulnerability that enables an attacker to gain root access through network access.

Urgent Recommendations from CISA

While there have been no confirmed real-world attacks exploiting these vulnerabilities, CISA is urging Federal Civilian Executive Branch (FCEB) agencies to remediate CVE-2024-1212 by December 9, 2024, to protect their networks. On November 20, 2024, CISA also included the VMware vCenter Server vulnerabilities in its KEV catalog, requiring agencies to implement vendor-recommended mitigations by December 11, 2024.

Recent Developments in Cybersecurity Threats

This news comes shortly after Sophos reported that cybercriminals are using a critical flaw in Veeam Backup & Replication (CVE-2024-40711, CVSS score: 9.8) to deploy a new ransomware variant known as Frag. Additionally, SonicWall detected exploitation attempts against CVE-2024-1212 in late March 2024, although details on the nature of these attacks remain unclear.

Conclusion: Stay Vigilant Against Cyber Threats

As organizations continue to navigate the complexities of cybersecurity, it is crucial to remain vigilant and proactive in addressing known vulnerabilities. For further insights into cybersecurity threats and best practices, consider exploring our related articles or sharing your thoughts in the comments below.

For ongoing updates, follow us on Twitter and LinkedIn to stay informed about the latest cybersecurity developments.

Learn more about cybersecurity measures here | Read about the latest vulnerabilities

SimpleHelp Flaws Enable File Theft and Remote Code Execution

January 15, 2025January 15, 2025

Cybersecurity experts have identified critical vulnerabilities in SimpleHelp remote access software, allowing for sensitive data exposure, privilege escalation, and remote code execution. Key flaws include an unauthenticated path traversal vulnerability (CVE-2024-57727) that lets attackers access sensitive files, an arbitrary file upload vulnerability (CVE-2024-57728) that permits malicious file uploads by admins, and a privilege escalation vulnerability (CVE-2024-57726) that enables low-privilege users to gain admin rights. SimpleHelp has released patches in versions 5.3.9, 5.4.10, and 5.5.8, urging users to update their systems and implement additional security measures promptly.

Google’s AI Tool Identifies 26 Vulnerabilities in Open Source

December 1, 2024December 1, 2024

Google’s OSS-Fuzz tool has identified 26 vulnerabilities in open-source code, including a medium-severity flaw in OpenSSL, labeled CVE-2024-9143. This out-of-bounds memory write bug, which could lead to application crashes or remote code execution, has been fixed in recent OpenSSL releases. The integration of AI and large language models into OSS-Fuzz has enhanced its fuzzing coverage, uncovering vulnerabilities that might have remained hidden for years. Additionally, Google is transitioning its codebases to memory-safe languages like Rust and implementing security measures in C++ to mitigate risks, reinforcing their commitment to improving open-source security.

Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks

Microsoft Patches Critical AI, Cloud Security Flaws Amid Attacks

December 1, 2024December 12, 2024

Microsoft has addressed four critical security vulnerabilities impacting its AI and cloud services, including one actively exploited flaw, CVE-2024-49035, a privilege escalation issue with a CVSS score of 8.7. This vulnerability allows unauthenticated attackers to gain elevated privileges due to improper access controls. Other vulnerabilities include CVE-2024-49038, a cross-site scripting issue, CVE-2024-49052, a missing authentication flaw in Azure PolicyWatch, and CVE-2024-49053, a spoofing issue in Dynamics 365 Sales. Users are advised to update their Dynamics 365 Sales apps to the latest version to enhance security. Regular software updates are essential for maintaining application security.

Researchers Discover Bypass for NTLMv1 Restrictions

January 16, 2025January 16, 2025

Cybersecurity experts have identified a vulnerability in Microsoft Active Directory Group Policy that allows the bypass of NT LAN Manager (NTLM) v1 authentication, despite efforts to disable it. This misconfiguration stems from the Netlogon Remote Protocol, which can still permit NTLM v1 under certain circumstances. Although NTLM v1 is deprecated, it remains in use for backward compatibility, posing security risks. To mitigate these vulnerabilities, organizations should enable audit logs, monitor vulnerable applications, and keep systems updated. Ongoing cybersecurity threats emphasize the need for vigilance and proactive measures to safeguard networks against potential breaches.

Mandiant: Chinese Hackers Target New Ivanti Vulnerabilities

January 10, 2025January 10, 2025

Recent research by Google Cloud’s Mandiant highlights a significant security threat linked to Ivanti products, revealing that vulnerabilities have been exploited by malicious actors to deploy SPAWN malware, including the SPAWNMOLE tunneller and SPAWNSNAIL SSH backdoor. This activity is traced to the UNC5337 threat group, connected to suspected Chinese espionage unit UNC5221. Mandiant warns of a potential mass exploitation scenario and urges Ivanti users to apply the latest patches immediately. Attackers are using deceptive techniques, such as fake upgrade progress bars, to mislead administrators. Users are advised to verify system integrity and educate their teams on cybersecurity threats.

ActiveState Unveils New End-to-End OS Platform for Enterprises

December 18, 2024December 18, 2024

ActiveState has launched a new platform designed to enhance open source management and security, addressing the complexities enterprises face as over 90% of software now includes open source components. With the rise of remote work increasing security risks, ActiveState’s platform implements a four-step management cycle: Discovery, Prioritization, Upgrading and Curating, and Build and Deploy. This structured approach aims to improve visibility, manage vulnerabilities, and ensure compliance. ActiveState’s initiative not only responds to the challenges of open source security but also empowers organizations by fostering collaboration and providing tools for effective governance and risk management.