{"id":17523,"date":"2023-04-03T09:47:51","date_gmt":"2023-04-03T16:47:51","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=17523"},"modified":"2023-04-24T10:19:08","modified_gmt":"2023-04-24T17:19:08","slug":"securins-threat-intelligence-apr-3-2023-apr-7-2023","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/securins-threat-intelligence-apr-3-2023-apr-7-2023_\/","title":{"rendered":"Securin&#8217;s Threat Intelligence: Apr 3, 2023 &#8211; Apr 7, 2023"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"17523\" class=\"elementor elementor-17523\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-02c8318 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"02c8318\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ddbe16e\" data-id=\"ddbe16e\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a3fa264 elementor-widget elementor-widget-text-editor\" data-id=\"a3fa264\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p dir=\"ltr\" style=\"line-height: 1.8; background-color: #ffffff; margin-top: 0pt; margin-bottom: 0pt; padding: 0pt 0pt 4pt; text-align: left;\"><strong><span style=\"color: #000000;\">This edition brings you early warnings, trending news about cyber threats, and the accurate threat context. Check out which threat group is on the rampage, what vulnerability it could soon weaponize, and more.<\/span><\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d81a1c5 elementor-widget elementor-widget-heading\" data-id=\"d81a1c5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Check out our Threat Intelligence Podcast hosted by David Rushton!\u200b<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-90d4e6a elementor-widget elementor-widget-text-editor\" data-id=\"90d4e6a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<div style=\"padding:50% 0 0 0;position:relative;\"><iframe src=\"https:\/\/player.vimeo.com\/video\/815693117?h=610fc3c2e6&amp;badge=0&amp;autopause=0&amp;player_id=0&amp;app_id=58479\" frameborder=\"0\" allow=\"autoplay; fullscreen; picture-in-picture\" allowfullscreen style=\"position:absolute;top:0;left:0;width:100%;height:100%;\" title=\"UNC4466 | CVE-2013-3900 | CVE-2023-29059 | Securin Threat Intelligence\"><\/iframe><\/div><script src=\"https:\/\/player.vimeo.com\/api\/player.js\"><\/script>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0f513b4 elementor-widget elementor-widget-spacer\" data-id=\"0f513b4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-06e09ce elementor-widget elementor-widget-heading\" data-id=\"06e09ce\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d7532f9 elementor-widget elementor-widget-text-editor\" data-id=\"d7532f9\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#windows-vulnerability-exploited-in-3cx-app-compromise\">Windows Vulnerability Exploited in 3CX App Compromise<\/a><\/li><li><a href=\"#CISA-Adds-CVE-2022-27926-to-its-Known-Vulnerabilities-Catalog\"><span style=\"font-weight: 400;\">CISA Adds CVE-2022-27926 to its Known Vulnerabilities Catalog<\/span><\/a><\/li><li><a href=\"#UNC4466-Targets-Vulnerable-Backup-Installations-to-Gain-Initial-Access\"><span style=\"font-weight: 400;\">UNC4466 Targets Vulnerable Backup Installations to Gain Initial Access<\/span><\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-45e16b3 elementor-widget elementor-widget-heading\" data-id=\"45e16b3\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78d7bb2 elementor-widget elementor-widget-text-editor\" data-id=\"78d7bb2\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"#multiple-vulnerabilities-in-unirpc-server\"><span style=\"font-weight: 400;\">Multiple Vulnerabilities in UniRPC Server<\/span><\/a><\/li><li><a href=\"#cve-2023-1707\"><span style=\"font-weight: 400;\">CVE-2023-1707: HP Printer Vulnerability<\/span><\/a><\/li><li><a href=\"#google-vulnerabilities\"><span style=\"font-weight: 400;\">Google Patches Three Vulnerabilities<\/span><\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c5581d4 elementor-widget elementor-widget-spacer\" data-id=\"c5581d4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-1272e27 elementor-widget elementor-widget-heading\" data-id=\"1272e27\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Trending Threats<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-585df2e elementor-widget elementor-widget-spacer\" data-id=\"585df2e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252bc8 elementor-widget elementor-widget-menu-anchor\" data-id=\"d252bc8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"windows-vulnerability-exploited-in-3cx-app-compromise\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-13dc0cf elementor-widget elementor-widget-heading\" data-id=\"13dc0cf\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Windows Vulnerability Exploited in 3CX App Compromise <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-55db5e8 elementor-widget elementor-widget-text-editor\" data-id=\"55db5e8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Last week, we <\/span><a href=\"https:\/\/www.securin.io\/securins-threat-intelligence-mar-27-2023-mar-31-2023\/#:~:text=vendor%20releases%20patches.-,Hackers%20Compromise%203CX%20Application%20to%20Launch%20Supply%20Chain%20Attacks,-Labyrinth%20Chollima%2C%20a\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">saw<\/span><\/a><span style=\"font-weight: 400;\"> how a trojanized version of the 3CX application is being exploited in a supply chain attack. It has now come to light that an old windows vulnerability is used by attackers to mark the executables as legitimately signed. <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2013-3900\" target=\"_blank\" rel=\"noopener\">CVE-2013-3900<\/a> is a WinVerifyTrust Signature Validation Vulnerability that does not alert users when an executable is modified and does not have a valid signature. In the supply chain attack, two DLLs used by the 3CX application were replaced with malicious versions that download additional malware to computers, including an information-stealing trojan.<\/span><\/p><p><span style=\"font-weight: 400;\">Microsoft had <\/span><a href=\"https:\/\/msrc.microsoft.com\/update-guide\/vulnerability\/CVE-2013-3900\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">fixed this vulnerability<\/span><\/a><span style=\"font-weight: 400;\"> but left it as an opt-in (users may apply the fix if needed). However, Windows versions 11 and up do not have this fix.<\/span><\/p><p><strong>We recommend that Microsoft make this fix a critical patch and warn users to apply it at the earliest. <\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-17fa62e elementor-widget elementor-widget-spacer\" data-id=\"17fa62e\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-449aa0b elementor-widget elementor-widget-menu-anchor\" data-id=\"449aa0b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"CISA-Adds-CVE-2022-27926-to-its-Known-Vulnerabilities-Catalog\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0e7d67 elementor-widget elementor-widget-heading\" data-id=\"f0e7d67\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">CISA Adds CVE-2022-27926 to its Known Vulnerabilities Catalog <\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e2cb52b elementor-widget elementor-widget-text-editor\" data-id=\"e2cb52b\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-27926\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-27926<\/span><\/a><span style=\"font-weight: 400;\"> is a Zimbra vulnerability that is actively exploited by a hacking group known as Winter Vivern. European entities are targeted by Winter Vivern using phishing emails that lead to the exploit of CVE-2022-27926. CISA added this to the KEV catalog on April 4, 2023 and recommended that all federal agencies <\/span><a href=\"https:\/\/wiki.zimbra.com\/wiki\/Zimbra_Releases\/9.0.0\/P24\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">patch<\/span><\/a><span style=\"font-weight: 400;\"> it by April 24, 2023.\u00a0<\/span><\/p><p><span style=\"font-weight: 400;\">Our cybersecurity experts called out this vulnerability as critical in last <\/span><a href=\"https:\/\/www.securin.io\/securins-threat-intelligence-mar-27-2023-mar-31-2023\/#:~:text=to%20apply%20it.-,CVE%2D2022%2D27926%3A%20Hackers%20Exploit%20this%20Zimbra%20Vulnerability,-CVE%2D2022%2D27926\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">week\u2019s threat intelligence blog<\/span><\/a><span style=\"font-weight: 400;\"> and also warned our customers regarding it.<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6d92e4d elementor-widget elementor-widget-spacer\" data-id=\"6d92e4d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-a60d553 elementor-widget elementor-widget-menu-anchor\" data-id=\"a60d553\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"UNC4466-Targets-Vulnerable-Backup-Installations-to-Gain-Initial-Access\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7e40c5c elementor-widget elementor-widget-heading\" data-id=\"7e40c5c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">UNC4466 Targets Vulnerable Backup Installations to Gain Initial Access<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e37bd35 elementor-widget elementor-widget-text-editor\" data-id=\"e37bd35\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27876\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-27876<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27877\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-27877<\/span><\/a><span style=\"font-weight: 400;\">, and <\/span><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021-27878\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2021-27878<\/span><\/a><span style=\"font-weight: 400;\"> are vulnerabilities in Veritas Backup Exec installations. They allow unauthenticated attackers to gain access and escalate privileges. An ALPHV (aka BlackCat ransomware) ransomware affiliate known as UNC4466 is exploiting these vulnerabilities to gain initial access. There are about 8000 instances of internet-exposed servers running Symantec\/Veritas Backup Exec ndmp services. UNC4466 made use of ADRecon to gather network, account, and host information in the victim\u2019s environment. It also used tools such as Background Intelligent Transfer Service (BITS), LAZAGNE, LIGOLO, WINSW, RCLONE, and the ALPHV ransomware encryptor. LIGOLO and REVSOCKS were used to run commands on the compromised server and also evade detection.\u00a0<\/span><\/p><p><strong>Veritas has <a href=\"https:\/\/www.veritas.com\/support\/en_US\/security\/VTS21-001\" target=\"_blank\" rel=\"noopener\">patched<\/a> these vulnerabilities and users should update their software versions immediately.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36afe28 elementor-widget elementor-widget-spacer\" data-id=\"36afe28\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0937f84 elementor-widget elementor-widget-heading\" data-id=\"0937f84\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Vulnerabilities to Watch Out For<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d574dff elementor-widget elementor-widget-spacer\" data-id=\"d574dff\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ba4d590 elementor-widget elementor-widget-menu-anchor\" data-id=\"ba4d590\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"multiple-vulnerabilities-in-unirpc-server\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-77b0b26 elementor-widget elementor-widget-heading\" data-id=\"77b0b26\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Multiple Vulnerabilities in UniRPC Server<\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-32bb1a4 elementor-widget elementor-widget-text-editor\" data-id=\"32bb1a4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">There are multiple vulnerabilities in Rocket Software&#8217;s UniData and UniVerse UniRPC server (and related services) running on the Linux platform.\u00a0<\/span><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28501\" target=\"_blank\" rel=\"noopener\">CVE-2023-28501<\/a>: Pre-authentication heap buffer overflow in unirpcd service<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28502\" target=\"_blank\" rel=\"noopener\">CVE-2023-28502<\/a>: Pre-authentication stack buffer overflow in udadmin_server service<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28504\" target=\"_blank\" rel=\"noopener\">CVE-2023-28504<\/a>: Pre-authentication stack buffer overflow in libunidata.so&#8217;s U_rep_rpc_server_submain()<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28507\" target=\"_blank\" rel=\"noopener\">CVE-2023-28507<\/a>: Pre-authentication memory exhaustion in LZ4 decompression in unirpcd service<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28503\" target=\"_blank\" rel=\"noopener\">CVE-2023-28503<\/a>: Authentication bypass in libunidata.so&#8217;s do_log_on_user() function<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28505\" target=\"_blank\" rel=\"noopener\">CVE-2023-28505<\/a>: Post-authentication buffer overflow in libunidata.so&#8217;s U_get_string_value() function<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28506\" target=\"_blank\" rel=\"noopener\">CVE-2023-28506<\/a>: Post-authentication stack buffer overflow in udapi_slave executable<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28508\" target=\"_blank\" rel=\"noopener\">CVE-2023-28508<\/a>: Post-authentication heap overflow in udsub service<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\"><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-28509\" target=\"_blank\" rel=\"noopener\">CVE-2023-28509<\/a>: Weak encryption<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">CVE-2023-28505, CVE-2023-28506, CVE-2023-28508 do not need any authentication details to be exploited because of CVE-2023-28503 (authentication bypass vulnerability).<\/span><\/p><p><strong>Rocket Software has fixed these vulnerabilities in hotfix version 8.2.4.3003 and recommends all users to apply it immediately.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d47b516 elementor-widget elementor-widget-spacer\" data-id=\"d47b516\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-eef6a9a elementor-widget elementor-widget-menu-anchor\" data-id=\"eef6a9a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"cve-2023-1707\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-dcb4099 elementor-widget elementor-widget-heading\" data-id=\"dcb4099\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">CVE-2023-1707: HP Printer Vulnerability<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-971e64a elementor-widget elementor-widget-text-editor\" data-id=\"971e64a\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">The vulnerability <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-24473\" target=\"_blank\" rel=\"noopener\">CVE-2023-1707<\/a> affects more than 50 HP Enterprise LaserJet and HP LaserJet Managed Printers models. It has a 9.1 rating on the CVSS scale making it a critical vulnerability. This vulnerability can be exploited by attackers if vulnerable machines run the FutureSmart firmware version 5.6 and have IPsec enabled. The attacker will be able to access\u00a0 sensitive information transmitted between the compromised HP printers and other devices on the network.<\/span><\/p><p><span style=\"font-weight: 400;\">HP, however, has not addressed this vulnerability yet and informed that a patch will be available within 90 days.\u00a0<\/span><\/p><p><strong>Meanwhile, customers running FutureSmart 5.6 can downgrade their firmware version to FS 5.5.0.3. as a mitigation measure.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-551aab8 elementor-widget elementor-widget-spacer\" data-id=\"551aab8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3e38b31 elementor-widget elementor-widget-menu-anchor\" data-id=\"3e38b31\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"menu-anchor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-menu-anchor\" id=\"google-vulnerabilities\"><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b359e43 elementor-widget elementor-widget-heading\" data-id=\"b359e43\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Google Patches Three Vulnerabilities<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f6632d8 elementor-widget elementor-widget-text-editor\" data-id=\"f6632d8\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"font-weight: 400;\">Google released a <\/span><a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2023-04-01\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">security bulletin<\/span><\/a><span style=\"font-weight: 400;\"> in April addressing Android vulnerabilities. Three of them are critical vulnerabilities:<\/span><\/p><p><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-21085\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2023-21085<\/span><\/a><span style=\"font-weight: 400;\"> enables a remote attacker to execute arbitrary code. The vulnerability is caused by inadequate input validation in the System component. By using a specially crafted file, an attacker can deceive the victim into opening it and running arbitrary code remotely.<\/span><\/p><p><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2023-21096\"><span style=\"font-weight: 400;\">CVE-2023-21096<\/span><\/a><span style=\"font-weight: 400;\">, a system component vulnerability that permits a remote attacker to execute arbitrary code. This vulnerability arises from inadequate input validation in the system component. By enticing the victim to open a specially crafted file, a remote attacker can run arbitrary code.<\/span><\/p><p><span style=\"font-weight: 400;\">The Arm Mali GPU kernel driver has a vulnerability, <\/span><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2022-38181\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CVE-2022-38181<\/span><\/a><span style=\"font-weight: 400;\"> that enables unprivileged users to access memory that has been freed, as a result of mishandled GPU memory operations. This vulnerability, known as use-after-free (UAF), enables a local application to escalate its privileges on the system. By triggering memory corruption, a local application can execute arbitrary code with elevated privileges. This vulnerability has been observed to be used in targeted attacks and was initially detected in November 2022.<\/span><\/p><p><strong>Android users should patch these vulnerabilities immediately.<\/strong><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c3359d elementor-widget elementor-widget-spacer\" data-id=\"9c3359d\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-5661ac2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"5661ac2\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-12cd24e\" data-id=\"12cd24e\" data-element_type=\"column\" data-settings=\"{&quot;background_background&quot;:&quot;classic&quot;}\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a79af4 elementor-widget elementor-widget-spacer\" data-id=\"6a79af4\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8edd1c elementor-widget elementor-widget-text-editor\" data-id=\"f8edd1c\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p style=\"text-align: center;\"><strong><span style=\"color: #000000;\">Follow our weekly blog and podcast to get proactive alerts on trending threats.<\/span><\/strong><\/p><p style=\"text-align: center;\"><strong>Leverage our expertise and manage your threats continuously to stay safe from attackers. <\/strong><a href=\"\/contact-us\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Talk to Us!<\/span><\/a><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-56b9a97 elementor-widget elementor-widget-spacer\" data-id=\"56b9a97\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>We bring you threats that are currently trending as well as new vulnerabilities that hackers are exploiting.<\/p>\n","protected":false},"author":1,"featured_media":13471,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":"","footnotes":""},"categories":[80,146],"tags":[653,637,638,89,419,641,93,640,639,654],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/17523"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/comments?post=17523"}],"version-history":[{"count":11,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/17523\/revisions"}],"predecessor-version":[{"id":18013,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/posts\/17523\/revisions\/18013"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/13471"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=17523"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/categories?post=17523"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/tags?post=17523"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}