imge
Login to Securin

Securin Team

Sep 23: CSW Patch Watch & Security Updates

CSW Patch Watch

Last week, Apple, CISCO, Google, Linux, and many other popular vendors released advisories for 105 vulnerabilities. 

Here is our analysis about these vulnerabilities –

  1. From among 105 vulnerabilities that were in focus this week, there were –
    1. 38 Hotfixes
    2. 2 Patches
    3. 65 updates 
  2. We delved further and analyzed these vulnerabilities and here are our findings –
    1. 37 vulnerabilities have known exploits and are weaponized
    2. 68 vulnerabilities are yet to be weaponized
  3. Among these 37 weaponized vulnerabilites we found –
    1. 6 CVEs have RCE capabilities enabling the attacker to execute arbitrary code
      1. CVE-2020-15962 (Google)
      2. CVE-2018-1000861 – 1, 2, 3 (Checkpoint)
      3. CVE-2015-2419 (Checkpoint)
      4. CVE-2020-16875 (Checkpoint)
      5. CVE-2020-10673 – 1, 2 (RedHat)
      6. CVE-2020-11113 (RedHat)
    2. Two CVEs are associated with ransomware
      1. Checkpoint’s CVE-2015-2419 (TeslaCrypt Ransomware)
      2. Checkpoint’s CVE-2020-16875 (Zeppelin Ransomware) 
  4. We also found that an alert had been issued for one of the vulnerabilities by CISA –
    1. CVE-2020-1472 – a design weakness in the Netlogon Remote Protocol login process  
  5. We also found that 35 old vulnerabilities (out of 105) ranging from years 2015 to 2019 –
    1. One old vulnerability is associated with ransomware –
    2. Nine of these vulnerabilities have exploits –
    3. Two of these vulnerabilities have RCE vulnerabilities

We urge you to patch the 37 CVEs that we have called out above as they are already weaponized.

Table1: Weaponized Vulnerabilities

Given below are 68 vulnerabilities and their patches for download. While patching the above given weaponized vulnerabilities is important, it would be optimum for cyber hygine to patch those that are yet to be weaponized.

Table 2: Vulnerabilities yet to be weaponized

Happy Patching
Team CSW

Share This Post On