Security Boulevard

There’s no doubt that API security is a hot topic these days. The continued growth in API-related breaches and increase in publicized API vulnerabilities has pushed API security to the top of CISO’s lists. The tools in the market for API security still have room for improvement, of course. One of the challenges security practitioners [...]

The post Context is King: Using API Sessions for Security Context appeared first on Wallarm.

The post Context is King: Using API Sessions for Security Context appeared first on Security Boulevard.

1. 4Critical
2. 82Important
3. 1Moderate
4. 0Low

Microsoft addresses 87 CVEs and one advisory (ADV240001) in its November 2024 Patch Tuesday release, with four critical vulnerabilities and four zero-day vulnerabilities, including two that were exploited in the wild.

Microsoft patched 87 CVEs in its November 2024 Patch Tuesday release, with four rated critical, 82 rated important and one rated moderate.

This month’s update includes patches for:

• .NET and Visual Studio
• Airlift.microsoft.com
• Azure CycleCloud
• Azure Database for PostgreSQL
• LightGBM
• Microsoft Exchange Server
• Microsoft Graphics Component
• Microsoft Office Excel
• Microsoft Office Word
• Microsoft PC Manager
• Microsoft Virtual Hard Drive
• Microsoft Windows DNS
• Role: Windows Hyper-V
• SQL Server
• TorchGeo
• Visual Studio
• Visual Studio Code
• Windows Active Directory Certificate Services
• Windows CSC Service
• Windows DWM Core Library
• Windows Defender Application Control (WDAC)
• Windows Kerberos
• Windows Kernel
• Windows NT OS Kernel
• Windows NTLM
• Windows Package Library Manager
• Windows Registry
• Windows SMB
• Windows SMBv3 Client/Server
• Windows Secure Kernel Mode
• Windows Task Scheduler
• Windows Telephony Service
• Windows USB Video Driver
• Windows Update Stack
• Windows VMSwitch
• Windows Win32 Kernel Subsystem

Remote code execution (RCE) vulnerabilities accounted for 58.6% of the vulnerabilities patched this month, followed by elevation of privilege (EoP) vulnerabilities at 29.9%.

Important CVE-2024-43451 | NTLM Hash Disclosure Spoofing Vulnerability

CVE-2024-43451 is a NTLM hash spoofing vulnerability in Microsoft Windows. It was assigned a CVSSv3 score of 6.5 and is rated as important. An attacker could exploit this flaw by convincing a user to open a specially crafted file. Successful exploitation would lead to the unauthorized disclosure of a user’s NTLMv2 hash, which an attacker could then use to authenticate to the system as the user. According to Microsoft, CVE-2024-43451 was exploited in the wild as a zero-day. No further details about this vulnerability were available at the time this blog post was published.

This is the second NTLM spoofing vulnerability disclosed in 2024. Microsoft patched CVE-2024-30081 in its July Patch Tuesday release.

Important CVE-2024-49039 | Windows Task Scheduler Elevation of Privilege Vulnerability

CVE-2024-49039 is an EoP vulnerability in the Microsoft Windows Task Scheduler. It was assigned a CVSSv3 score of 8.8 and is rated as important. An attacker with local access to a vulnerable system could exploit this vulnerability by running a specially crafted application. Successful exploitation would allow an attacker to access resources that would otherwise be unavailable to them as well as execute code, such as remote procedure call (RPC) functions.

According to Microsoft, CVE-2024-49039 was exploited in the wild as a zero-day. It was disclosed to Microsoft by an anonymous researcher along with Vlad Stolyarov and Bahare Sabouri of Google's Threat Analysis Group. At the time this blog post was published, no further details about in-the-wild exploitation were available.

Important CVE-2024-49019 | Active Directory Certificate Services Elevation of Privilege Vulnerability

CVE-2024-49019 is an EoP vulnerability affecting Active Directory Certificate Services. It was assigned a CVSSv3 score of 7.8 and is rated as important. It was publicly disclosed prior to a patch being made available. According to Microsoft, successful exploitation would allow an attacker to gain administrator privileges. The advisory notes that “certificates created using a version 1 certificate template with Source of subject name set to ‘Supplied in the request’” are potentially impacted if the template has not been secured according to best practices. This vulnerability is assessed as “Exploitation More Likely” according to Microsoft’s Exploitability Index. Microsoft’s advisory also includes several mitigation steps for securing certificate templates which we highly recommend reviewing.

Important CVE-2024-49040 | Microsoft Exchange Server Spoofing Vulnerability

CVE-2024-49040 is a spoofing vulnerability affecting Microsoft Exchange Server 2016 and 2019. It was assigned a CVSSv3 score of 7.5 and rated as important. According to Microsoft, this vulnerability was publicly disclosed prior to a patch being made available. After applying the update, administrators should review the support article Exchange Server non-RFC compliant P2 FROM header detection. The supplemental guide notes that as part of a “secure by default” approach, the Exchange Server update for November will flag suspicious emails which may contain “malicious patterns in the P2 FROM header.” While this feature can be disabled, Microsoft strongly recommends leaving it enabled to provide further protection from phishing attempts and malicious emails.

Critical CVE-2024-43639 | Windows Kerberos Remote Code Execution Vulnerability

CVE-2024-43639 is a critical RCE vulnerability affecting Windows Kerberos, an authentication protocol designed to verify user or host identities. It was assigned a CVSSv3 score of 9.8 and is rated as “Exploitation Less Likely.”

To exploit this vulnerability, an unauthenticated attacker needs to leverage a cryptographic protocol vulnerability in order to achieve RCE. No further details were provided by Microsoft about this vulnerability at the time this blog was published.

Important 29 CVEs | SQL Server Native Client Remote Code Execution Vulnerability

This month's release included 29 CVEs for RCEs affecting SQL Server Native Client. All of these CVEs received CVSSv3 scores of 8.8 and were rated as “Exploitation Less Likely.” Successful exploitation of these vulnerabilities can be achieved by convincing an authenticated user into connecting to a malicious SQL server database using an affected driver. A full list of the CVEs are included in the table below.

CVE Description CVSSv3 CVE-2024-38255 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-43459 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-43462 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48993 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48994 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48995 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48996 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48997 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48998 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-48999 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49000 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49001 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49002 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49003 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49004 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49005 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49006 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49007 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49008 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49009 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49010 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49011 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49012 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49013 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49014 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49015 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49016 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49017 SQL Server Native Client Remote Code Execution Vulnerability 8.8 CVE-2024-49018 SQL Server Native Client Remote Code Execution Vulnerability 8.8 Important CVE-2024-43602 | Azure CycleCloud Remote Code Execution Vulnerability

CVE-2024-43602 is a RCE vulnerability in Microsoft’s Azure CycleCloud, a tool that helps in managing and orchestrating High Performance Computing (HPC) environments in Azure. This flaw received the highest CVSSv3 score of the month, a 9.9 and was rated as important. A user with basic permissions could exploit CVE-2024-43602 by sending specially crafted requests to a vulnerable AzureCloud CycleCloud cluster to modify its configuration. Successful exploitation would result in the user gaining root permissions, which could then be used to execute commands on any cluster in the Azure CycleCloud as well as steal admin credentials.

Tenable Solutions

A list of all the plugins released for Microsoft’s November 2024 Patch Tuesday update can be found here. As always, we recommend patching systems as soon as possible and regularly scanning your environment to identify those systems yet to be patched.

For more specific guidance on best practices for vulnerability assessments, please refer to our blog post on How to Perform Efficient Vulnerability Assessments with Tenable.

Get more information

• Microsoft's November 2024 Security Updates
• Tenable plugins for Microsoft November 2024 Patch Tuesday Security Updates

Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable One, the Exposure Management Platform for the modern attack surface.

The post Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039) appeared first on Security Boulevard.

Permalink

The post Randall Munroe’s XKCD ‘Proterozoic Rocks’ appeared first on Security Boulevard.

DataDome's point of presence (PoP) network has expanded to over 30 locations worldwide, delivering seamless, fast protection to our customers across the globe.

The post Scaling Global Protection: DataDome Expands to Over 30 Points of Presence (PoP) Worldwide appeared first on Security Boulevard.

Let's explore the latest book by Packt Publishing on "Pentesting APIs" and see if it's worth putting on an API hacker's bookshelf.

The post Is the latest book on “Pentesting APIs” any good? appeared first on Dana Epp's Blog.

The post Is the latest book on “Pentesting APIs” any good? appeared first on Security Boulevard.

Infostealer malware represents one of the most underrated threats to corporate and consumer information security today. These sophisticated remote access Trojans (RATs) silently infect computers and systematically exfiltrate massive amounts of sensitive information from the host to threat actors’ command and control (C2) infrastructure. Their primary targets include: Once the information has been exfiltrated, it […]

The post Infostealer Malware: An Introduction appeared first on Flare | Cyber Threat Intel | Digital Risk Protection.

The post Infostealer Malware: An Introduction appeared first on Security Boulevard.

Authors/Presenters: Samy Kamkar

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Optical Espionage: Using Lasers to Hear Keystrokes Through Glass Windows appeared first on Security Boulevard.

Recently identified npm packages called "node-request-ip", "request-ip-check" and "request-ip-validator" impersonate handy open source utilities relied upon by developers to retrieve an external IP address but instead target Windows, Linux and macOS users with malicious executables which are trojans and cryptocurrency stealers.

The post Fake IP checker utilities on npm are crypto stealers appeared first on Security Boulevard.

Are you interested in digging a little deeper into how Tidal Cyber works? Our video library of brief demo tours shows how Tidal Cyber empowers security teams with Threat-Informed Defense. Each video dives into a different aspect of Tidal Cyber Enterprise Edition, so that in 5-minutes or less you can understand how to use a specific capability and the value it delivers.

The post Explore Tidal Cyber with our Demo Video Library appeared first on Security Boulevard.

We’re honored to share a new partnership with Orange Business (Norway), a global leader in digital services. ARMO

The post ARMO selected by Orange Business to Secure its Managed Kubernetes Services appeared first on ARMO.

The post ARMO selected by Orange Business to Secure its Managed Kubernetes Services appeared first on Security Boulevard.

User access reviews are periodic evaluations of access rights to ensure they align with users’ roles, reducing security risks and helping maintain regulatory compliance. The main goal of user access reviews is to prevent unauthorized access to sensitive information, systems, or resources by regularly verifying and adjusting user permissions. When and where are UARs needed,...

The post Creating an Effective User Access Review Program in 12 Simple Steps appeared first on Hyperproof.

The post Creating an Effective User Access Review Program in 12 Simple Steps appeared first on Security Boulevard.

In an era where cyber threats to critical infrastructure are growing in both sophistication and frequency, securing Operational Technology (OT), […]

The post Protecting Critical Infrastructure: A Collaborative Approach to Security for ICS, OT, and IIoT appeared first on Security Boulevard.

National insurance firm Crum and Forster is offering a professional liability program for CISOs who are facing growing regulatory pressures and sophisticate cyberattacks but often are not covered by their organizations' D&O policies.

The post Insurance Firm Introduces Liability Coverage for CISOs appeared first on Security Boulevard.

It’s been a little over a year since we first introduced security levels into Spectra Assure™ with the goal of reducing the remediation burden on developers. It automatically generates a plan for addressing prioritized software risks, recommending manageable projects to continually improve the software’s level of supply chain security in the same way that developers continually improve software capabilities.

The post Gauging the Safety Level of Your Software with Spectra Assure appeared first on Security Boulevard.

New guidance for organizations seeking to protect the generative AI tools they're running has been released by the OWASP Top 10 LLM Applications Security Project.

The post OWASP Top 10 for LLM and new tooling guidance targets GenAl security appeared first on Security Boulevard.

Discover the 5 best vendor risk management solutions, designed to help you mitigate third-party risks while ensuring compliance.

The post 5 Best Vendor Risk Management Solutions appeared first on Scytale.

The post 5 Best Vendor Risk Management Solutions appeared first on Security Boulevard.

Augmented reality use cases have become prevalent in our society.

The technology, which first emerged primarily in the world of gaming and entertainment, now promises to reshape our reality with interactive information and immersive experiences. In short, AR is undoubtedly … (more…)

The post GUEST ESSAY: The promise and pitfalls of using augmented reality– ‘AR’ — in cybersecurity first appeared on The Last Watchdog.

The post GUEST ESSAY: The promise and pitfalls of using augmented reality– ‘AR’ — in cybersecurity appeared first on Security Boulevard.

 

I didn’t see much visibility on this DocuSign hack. This is a situation where the product features were not vetted to understand if they could be misused by malicious fraudsters. There is not a technical vulnerability, it comes down to a design weakness in the product.

According to the security team at Wallarm, “An attacker creates a legitimate, paid DocuSign account that allows them to change templates and use the API directly.” They then employ a special template that masquerades as a well-known brand to send the billing invoice. Because the fraudulent invoice is directly sent from the DocuSign platform, it appears legitimate and won’t be stopped by email filters.

The entire process can be automated and sent out on a massive scale, spraying large numbers of unsuspecting victims.

It is the old story of well-intentioned developers asking if they “can” develop something without questioning if they “should” develop something.

It often takes security-minded experts, savvy in the ways of how attackers think, to evaluate such situations. These are often missed by even experienced developers because there is no technical vulnerability per se. But that does not mean a creative adversary can’t use it in destructive ways. Often, additional controls, oversight, or accountability must be included to dissuade, prevent, or quickly alert of misuse.

The sustainable solution for all software and service vendors is to have cybersecurity experts, not just security-minded developers, as part of the initial feature design teams, keep them in the loop during development, and make sure they vet the final capabilities before going live.

The post Fraudsters Abuse DocuSign API for Legit-Looking Invoices appeared first on Security Boulevard.

Flare recently hosted our first Threat Intel Workshop with Senior Threat Intelligence Researcher Tammy Harper. Below are some of the questions Tammy covered in improving threat intelligence collection practices. 1. How does the disruption to Telegram affect threat actors? After the arrest of Telegram CEO in August 2024, the messaging platform that has been popular […]

The post 6 Things to Know About Improving Threat Intelligence Collection appeared first on Flare | Cyber Threat Intel | Digital Risk Protection.

The post 6 Things to Know About Improving Threat Intelligence Collection appeared first on Security Boulevard.

Authors/Presenters: Michael Gorelik, Arnold Osipov

Our sincere appreciation to DEF CON, and the Presenters/Authors for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Outlook Unleashing RCE Chaos CVE 2024 30103 appeared first on Security Boulevard.