Another Drupal Remote Code Execution vulnerability has been discovered and was made public on April 25th, 2018, making this the 3rd vulnerability and 2nd “Highly Critical Vulnerability” to be disclosed in the last 30 days for the Drupal Core. The vulnerability (CVE-2018-7602) allows an attacker to exploit multiple attack vectors of the subsystems of Drupal 7.x and 8.x, resulting in a complete compromise of the site. There are reports that this vulnerability is currently being exploited in the wild.

A remote code execution vulnerability has been discovered and was made public on March 28th 2018, exist within multiple subsystems of Drupal 7.x and Drupal 8.x, potentially allowing attackers to exploit multiple attack vectors on a site running Drupal. This will result in a complete compromise of the site. The vulnerability has been given the CVE identification of CVE-2018-7600. As of the writing of this alert, Drupal has not identified a public exploit in the wild yet, but it is safe to say that due the criticality of the vulnerability, users should expect possible exploits to be developed and utilised maliciously. Hence, application of the now-released fix is gravely recommended.

It has been confirmed that a newly discovered flaws in Intel Processors at the hardware level could allow programs to steal data from running applications. In a typical case, programs are not allowed to read data from other programs. However a malware exploiting these new vulnerabilities can get data from the memory of currently running programs. This includes confidential information such as business-critical documents, passwords, login details, encryption keys, etc. The vulnerabilities have been named Meltdown (CVE-2017-5754) and Spectre (CVE-2017-5753 and CVE-2017-5715).

WordPress is an very popular open source software used by bloggers and millions of websites. A new security update, WordPress 4.8.3 is released, which addresses a potential SQL injection vulnerability. This update was released on October 31st and is available for public download.

BlueBorne is an attack vector can leverage Bluetooth connections to penetrate and take complete control over targeted devices. BlueBorne affects ordinary computers, mobile phones, and the expanding realm of IoT devices. The attack does not require the targeted device to be paired to the attacker’s device, or even to be set on discoverable mode.

A new Ransomware variant with worm like capabilities has infected many organizations around the world. The media is calling it "Petya" but it is not similar to the Petya variants seen before. In the propagation process, the malware enumerates all network adapters, all known server names via NetBIOS and also retrieves the list of current DHCP leases, if available. Each and every IP on the local network and each server found is checked for open TCP ports 445 and 139. Those machines that have these ports open are then attacked with one of the methods described above.

Drupal has released an advisory to address several vulnerabilities in Drupal versions 7.x and 8.x. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. (Advisory ID: DRUPAL-SA-CORE-2017-003)

Ransomware attacks dubbed as “WannaCry” started to spread around the world on the 12th May 2017. In these attacks, data is encrypted with the extension “.WCRY” added to the file names. According to the reports, this attack initiated through an SMBv1 remote code execution vulnerability in Microsoft Windows code-named “EternalBlue”. The exploit “EternalBlue” has been made available on the internet through the Shadowbrokers dump on 14th April 2017.
Microsoft released security patch updates for this vulnerability on 14th March 2017 in Microsoft Security Bulletin MS17-010.

Apache issued an emergency security alert as, Apache Struts was exposed to a high-risk remote command execution vulnerability, tracked as CVE-2017-5638. Public exploits are readily available. Struts is an open source project of the Apache Foundation Jakarta project team, which uses MVC mode to help Java developers use J2EE to develop Web applications. At present, Struts is widely used in large-scale Internet companies, government, financial institutions and other sites, and as the development of the underlying template to use.

WordPress 4.7.1 and prior versions are affected by multiple vulnerabilities. A remote attacker could exploit some of these vulnerabilities to take control of an affected website.

Vulnerabilities Addressed

WordPress versions 4.7.1 and earlier are affected by four issues:

  1. The user interface for assigning taxonomy terms in Press, This is shown to users who do not have permissions to use it.
  2. WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plug-ins and themes from accidentally causing a vulnerability.
  3. A cross-site scripting (XSS) vulnerability was discovered in the posts list table
  4. An unauthenticated privilege escalation vulnerability was discovered in a REST API endpoint.

On February 1, WordPress disclosed an additional vulnerability that is fixed in version 4.7.2.

Recomm­ended Course Of Action

TechCERT encourages users and administrators to review the WordPress Security Release and upgrade to WordPress 4.7.2.

Additional Information

footerimage

Member of

logo apcertfirst logo-2

Collaborated with

apwg2ICTA logo2ack cymru

Our Partners
lanka-certify-logoDark-Lab-Logo2contact