Ivanti Releases Urgent Security Updates for CSA and Connect

December 11, 2024December 11, 2024

Ivanti Releases Critical Security Updates for Cloud Services Application and Connect Secure

Ivanti has announced crucial security updates aimed at addressing multiple critical vulnerabilities in its Cloud Services Application (CSA) and Connect Secure products. These security flaws could potentially lead to privilege escalation and remote code execution, posing significant risks to users. To ensure your systems remain secure, it’s essential to take immediate action and update to the latest versions.

Overview of Critical Vulnerabilities in Ivanti Products

The vulnerabilities identified in Ivanti’s Cloud Services Application and Connect Secure products include several high-severity issues:

CVE-2024-11639 (CVSS score: 10.0): This authentication bypass vulnerability affects the admin web console of Ivanti CSA prior to version 5.0.3, allowing a remote unauthenticated attacker to gain administrative access.
CVE-2024-11772 (CVSS score: 9.1): A command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.3, which can enable a remote authenticated attacker with admin privileges to execute code remotely.
CVE-2024-11773 (CVSS score: 9.1): An SQL injection vulnerability in the admin web console of Ivanti CSA before version 5.0.3 that permits a remote authenticated attacker to execute arbitrary SQL statements.
CVE-2024-11633 (CVSS score: 9.1): This argument injection vulnerability in Ivanti Connect Secure prior to version 22.7R2.4 allows a remote authenticated attacker with admin privileges to execute code remotely.
CVE-2024-11634 (CVSS score: 9.1): A command injection vulnerability impacting both Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2, enabling remote authenticated attackers to gain code execution.
CVE-2024-8540 (CVSS score: 8.8): An insecure permissions vulnerability in Ivanti Sentry before versions 9.20.2, 10.0.2, and 10.1.0 that allows local authenticated attackers to modify sensitive application components.

Recommended Versions to Mitigate Vulnerabilities

To protect against these vulnerabilities, Ivanti recommends updating to the following versions:

Ivanti Cloud Services Application: Version 5.0.3 or later
Ivanti Connect Secure: Version 22.7R2.4 or later
Ivanti Policy Secure: Version 22.7R1.2 or later
Ivanti Sentry: Versions 9.20.2, 10.0.2, or 10.1.0

While Ivanti has stated that it is not aware of active exploitation of these vulnerabilities at this time, users should remain vigilant. Several security flaws have previously been exploited by state-sponsored attackers for malicious activities, making timely updates crucial.

Stay Informed and Secure

For more insights on cybersecurity updates and practices, consider following us on Twitter and LinkedIn for exclusive content. Share your thoughts or experiences regarding these updates in the comments below!

New DoubleClickjacking Exploit Bypasses Web Protections

January 1, 2025January 1, 2025

A newly identified vulnerability called DoubleClickjacking poses serious risks to major websites by enabling clickjacking attacks and potential account takeovers. Security researcher Paulos Yibelo highlights this timing-based vulnerability, which exploits a double-click sequence, complicating web security. Unlike traditional clickjacking, DoubleClickjacking manipulates user interfaces by leveraging the time gap between clicks. Attacks typically involve user interaction with a deceptive page, leading to unauthorized permissions. Existing security measures, like X-Frame-Options, are inadequate against this threat. To mitigate risks, website owners are advised to implement client-side prevention strategies and advocate for new browser standards.

CISA Flags Critical BeyondTrust Vulnerability As Exploited

December 20, 2024December 20, 2024

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has highlighted a critical security flaw, CVE-2024-12356, in BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) products, scoring 9.8 on the CVSS scale. This command injection vulnerability allows unauthorized attackers to execute commands with user privileges. Users are urged to update to the latest patches for self-hosted versions. Recent cyberattacks on BeyondTrust revealed compromised SaaS instances, and a medium-severity vulnerability (CVE-2024-12686, CVSS 6.6) has also been identified. Staying informed about updates and security practices is crucial for users.

Microsoft MFA Flaw Allows Unlimited Brute-Force Attacks

December 11, 2024December 11, 2024

Cybersecurity experts have discovered a critical vulnerability in Microsoft’s multi-factor authentication (MFA) system, known as AuthQuake, which allows attackers to bypass MFA protections and gain unauthorized access to user accounts. This issue arises from inadequate rate limiting and extended code validity, enabling attackers to attempt numerous login permutations without detection. Microsoft addressed the vulnerability in October 2024 by implementing stricter rate limits and requiring downtime after failed attempts. Experts emphasize the necessity of proper MFA configuration, including enabling notifications for failed logins and conducting regular security audits, to enhance user account protection.

Apple Issues Critical Updates for Active Zero-Day Vulnerabilities

December 1, 2024December 1, 2024

Apple has released crucial security updates for iOS, iPadOS, macOS, visionOS, and Safari to address two critical zero-day vulnerabilities being actively exploited. The primary vulnerability, CVE-2024-44308, has a high severity score of 8.8 and can allow arbitrary code execution through malicious web content. The second, CVE-2024-44309, has a score of 6.1 and is linked to cookie management issues that could lead to cross-site scripting attacks. Users are urged to update their devices promptly to protect against these threats, which have been linked to targeted attacks potentially involving government-backed spyware.

Mirai Botnet Targets Four-Faith Routers for DDoS Attacks

January 8, 2025January 8, 2025

A new variant of the Mirai botnet, named “gayfemboy,” is exploiting a critical vulnerability (CVE-2024-12856) in Four-Faith industrial routers, leading to increased distributed denial-of-service (DDoS) attacks since November 2024. This botnet, active since February 2024, targets weak Telnet credentials and over 20 known vulnerabilities, with approximately 15,000 active IP addresses primarily in China, Iran, Russia, Turkey, and the U.S. The attacks can generate traffic of around 100 Gbps and pose significant risks to enterprises and individual users. Experts emphasize the growing threat of DDoS attacks and the urgent need for improved cybersecurity measures.

Critical OpenWrt Flaw Allows Malicious Firmware Injection

December 13, 2024December 13, 2024

A critical vulnerability, CVE-2024-54143, has been discovered in OpenWrt’s Attended Sysupgrade (ASU) feature, posing a significant risk of malicious firmware distribution. Identified by Flatt Security’s RyotaK on December 4, 2024, it has a CVSS score of 9.3 and allows command injection and SHA-256 hash collisions, enabling attackers to replace legitimate firmware without authentication. OpenWrt has released version 920c8a1 to address this issue. Users are urged to update, review security protocols, and monitor for further updates to protect their devices. The OpenWrt community is actively discussing the vulnerability and its implications.