2024/09/08 週 セキュリティニュースメモ

はじめに

• 自身なりに気になったセキュリティ情報の 私のメモ です
• 毎週日曜日起点で作成し、土曜日まで、その週の記事を更新し続けます
  • zennでの公開は、翌週の記事を作成したタイミングで実施します。ただし、GitHub上では常にpublicです。そのため、zenn上で未公開でも、GitHub上では確認 はできます。
• あくまで、発見した週に記入します(タイトルが近い場合は、最初に見つけた週)
  • 1週間以上前の出来事は、極力日付を入れる気持ちではいますが、確実性はありません
  • 今週にhinoshibaが見つけたニュースである事に留意ください
• 実質的には、セキュリティは楽しいかね？ Part 2 のような事ができるようになったらいいなと、個人的に真似をして、個人的に漏れチェック等に使います

事件事故

攻撃、脅威

• KFC メキシコの顧客データが販売されている
  • https://dailydarkweb.net/threat-actor-claims-to-sell-kfc-mexico-customer-database-with-over-349000-records/
• サイバー攻撃によりアメリカやイギリスの学校が影響を受ける
  • https://www.theregister.com/2024/09/11/uk_us_school_ransomware/
• Fortinet 440GBのデータ侵害を確認
  • https://www.bleepingcomputer.com/news/security/fortinet-confirms-data-breach-after-hacker-claims-to-steal-440gb-of-files/
  • https://securityonline.info/fortinet-faces-potential-data-breach-customer-data-at-risk/
  • https://www.darkreading.com/cloud-security/fortinet-customer-data-breach-third-party
• アベニュー関連会社、ランサムウェア被害。セキュリティ機器の設定変更を行った際、設定ミスによってセキュリティ上の不備が発生
  • https://www.security-next.com/161808
• シアトル航空 8月の攻撃でランサムウェアに感染
  • https://www.bleepingcomputer.com/news/security/port-of-seattle-says-rhysida-ransomware-was-behind-august-attack/
• ロンドン交通、攻撃を受けた30,000の従業員にパスワードリセットをリクエスト
  • https://www.bleepingcomputer.com/news/security/tfl-requires-in-person-password-resets-for-30-000-employees-after-hack/
• マルウェアHadooken WebLogicをターゲットにするもの
  • https://www.bleepingcomputer.com/news/security/new-linux-malware-hadooken-targets-oracle-weblogic-servers/
• RansomHub カワサキにサイバー攻撃を主張したと主張
  • https://www.bleepingcomputer.com/news/security/ransomhub-claims-kawasaki-cyberattack-threatens-to-leak-stolen-data/
• Hulu リスト型攻撃と思われる攻撃を受けている
  • https://www.security-next.com/161851

脆弱性

• CVE-2024-24759 AI等で利用されているMindsDB、SSRFの脆弱性
  • https://securityonline.info/mindsdb-fixes-critical-cve-2024-24759-dns-rebinding-attack-bypasses-security-protections/
• CVE-2024-37288 and CVE-2024-37285 Kibana 任意のコード実行
  • https://securityonline.info/critical-kibana-flaws-cve-2024-37288-cve-2024-37285-expose-systems-to-arbitrary-code-execution/
  • https://rocket-boys.co.jp/8076/
• CVE-2024-26230 Windows 4月に修正された権限昇格の脆弱性のPoC公開
  • https://securityonline.info/poc-exploit-releases-for-windows-elevation-of-privilege-vulnerability-cve-2024-26230/
• CVE-2024-29847 Ivanti EPM 任意のコード実行の脆弱性
  • https://www.bleepingcomputer.com/news/security/ivanti-fixes-maximum-severity-rce-bug-in-endpoint-management-software/
  • https://securityonline.info/ivanti-issues-patch-for-critical-vulnerabilities-in-endpoint-manager-including-cve-2024-29847-cvss-10-0/
  • https://www.securityweek.com/ivanti-patches-critical-vulnerabilities-in-endpoint-manager/
  • https://thehackernews.com/2024/09/ivanti-releases-urgent-security-updates.html
  • PoCリリース
    • https://www.bleepingcomputer.com/news/security/exploit-code-released-for-critical-ivanti-rce-flaw-patch-now/
    • https://securityonline.info/poc-exploit-released-for-ivanti-epm-flaw-cve-2024-29847-cvss-10/
• CVE-2024-41869 CVE-2024-45112 Adobe Acrobat Reader 他 任意のコード実行の脆弱性。PoCあり
  • https://helpx.adobe.com/security/products/acrobat/apsb24-70.html
  • https://www.securityweek.com/adobe-patches-critical-code-execution-flaws-in-multiple-products/
  • https://www.bleepingcomputer.com/news/security/adobe-fixes-acrobat-reader-zero-day-with-public-poc-exploit/
• CVE-2024-7889 and CVE-2024-7890 Citrix Workspace app for Windows 権限昇格の脆弱性
  • https://support.citrix.com/s/article/CTX691485-citrix-workspace-app-for-windows-security-bulletin-cve20247889-and-cve20247890?language=en_US
  • https://securityonline.info/citrix-workspace-app-users-urged-to-update-following-two-privilege-escalation-flaws/
• CVE-2024-8695 DockerDesktop 拡張機能の説明悪用により任意のコード実行の脆弱性
  • https://cvefeed.io/vuln/detail/CVE-2024-8695
  • https://securityonline.info/cve-2024-8695-cve-2024-8696-two-critical-rce-flaws-discovered-in-docker-desktop/
• CVE-2024-6678 GitLab 未認証のPipeline実行の脆弱性
  • https://thehackernews.com/2024/09/urgent-gitlab-patches-critical-flaw.html
  • https://www.bleepingcomputer.com/news/security/gitlab-warns-of-critical-pipeline-execution-vulnerability/
  • https://securityonline.info/gitlab-issues-critical-security-patch-for-cve-2024-6678-cvss-9-9-urges-immediate-update/
  • https://www.bitdefender.com/blog/hotforsecurity/gitlab-issues-emergency-patch-for-pipeline-exploitation-vulnerability/
  • https://www.securityweek.com/gitlab-updates-resolve-critical-pipeline-execution-vulnerability/
• CVE-2024-8522 and CVE-2024-8529 WordPress Plugin LearnPress SQLi
  • https://securityonline.info/cve-2024-8522-cvss-10-learnpress-sqli-flaw-leaves-90k-wordpress-sites-at-risk/
  • https://www.security-next.com/161830
• CVE-2024-45409 Ruby-SAML 認証Bypassの脆弱性
  • https://securityonline.info/cve-2024-45409-cvss-10-critical-ruby-saml-flaw-leaves-user-accounts-exposed/
  • https://www.security-next.com/161853
  • GitLabの緊急セキュリティパッチとなる
    • https://about.gitlab.com/releases/2024/09/17/patch-release-gitlab-17-3-3-released/
    • https://www.darkreading.com/application-security/gitlab-warns-max-severity-authentication-bypass-bug
    • https://www.securityweek.com/gitlab-patches-critical-authentication-bypass-vulnerability/
    • https://thehackernews.com/2024/09/gitlab-patches-critical-saml.html
    • https://blog.projectdiscovery.io/ruby-saml-gitlab-auth-bypass/
• CVE-2024-8686 PaloAlto PAN-OS コマンドインジェクションの脆弱性
  • https://securityonline.info/pan-os-vulnerabilities-command-injection-cve-2024-8686-and-globalprotect-exposure-cve-2024-8687/
• WindowsUpdate
  • info
    • https://msrc.microsoft.com/update-guide/vulnerability
    • https://msrc.microsoft.com/update-guide/releaseNote/2024-Sep
    • https://krebsonsecurity.com/2024/09/bug-left-some-windows-pcs-dangerously-unpatched/
    • https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-server-performance-issues-from-august-updates/
    • https://www.securityweek.com/microsoft-says-windows-update-zero-day-being-exploited-to-undo-security-fixes/
    • https://www.bleepingcomputer.com/news/microsoft/windows-10-kb5043064-update-released-with-6-fixes-security-updates/
    • https://www.bleepingcomputer.com/news/microsoft/microsoft-september-2024-patch-tuesday-fixes-4-zero-days-79-flaws/
    • https://securityboulevard.com/2024/09/patch-tuesday-september-2024-richixbw/
• KEV
  • CVE-2016-3714 ImageMagick Improper Input Validation Vulnerability
  • CVE-2017-1000253 Linux Kernel PIE Stack Buffer Corruption Vulnerability
  • CVE-2024-40766 SonicWall SonicOS Improper Access Control Vulnerability
    • https://jp.inoreader.com/article/3a9c6e745fcd536b-akira-ransomware-exploits-sonicwall-sslvpn-flaw-cve-2024-40766
    • https://www.darkreading.com/ics-ot-security/akira-ransomware-actors-exploit-sonicwall-bug-for-rce
    • https://www.security-next.com/161650
    • https://www.bleepingcomputer.com/news/security/critical-sonicwall-sslvpn-bug-exploited-in-ransomware-attacks/
  • CVE-2024-38226 Microsoft Publisher Security Feature Bypass Vulnerability
  • CVE-2024-43491 Microsoft Windows Update Remote Code Execution Vulnerability
  • CVE-2024-38014 Microsoft Windows Installer Privilege Escalation Vulnerability
  • CVE-2024-38217 Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
    • https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-windows-smart-app-control-zero-day-exploited-since-2018/
  • CVE-2024-8190 Ivanti Cloud Services Appliance 任意のコード実行
    • https://securityonline.info/cisa-ivanti-warn-of-active-exploitation-cloud-services-appliance-flaw-cve-2024-8190/
    • https://thehackernews.com/2024/09/ivanti-warns-of-active-exploitation-of.html
    • https://www.bleepingcomputer.com/news/security/ivanti-warns-high-severity-csa-flaw-is-now-exploited-in-attacks/
    • https://www.cisa.gov/news-events/alerts/2024/09/13/ivanti-releases-security-update-cloud-services-appliance

その他

• NGINX GitHubへ移行
  • https://forest.watch.impress.co.jp/docs/news/1622344.html
  • https://securityonline.info/nginx-open-source-makes-the-jump-to-github-boosting-collaboration-and-community-engagement/
• カスペルスキー、米国事業縮小に関連して、移行先UltraAVを案内
  • https://www.securityweek.com/one-million-us-kaspersky-customers-transferred-to-pangos-ultraav/
• Windows 22H2 を23H2 に強制アップグレードすることを発表。10/8を予定
  • https://www.bleepingcomputer.com/news/microsoft/microsoft-to-start-force-upgrading-windows-22h2-systems-next-month/
  • https://www.theregister.com/2024/09/11/microsoft_23h2_forced_update/
• 10/1よりWodPressPlugin開発者やサイト管理者に対して2FAを要求するようになる。WordPress.org
  • https://www.bleepingcomputer.com/news/security/wordpressorg-to-require-2fa-for-plugin-developers-by-october/
  • https://www.bitdefender.com/blog/hotforsecurity/wordpress-to-enforce-2fa-and-separate-credentials-for-website-admin-and-plugin-management/
  • https://www.tripwire.com/state-of-security/wordpress-plugin-and-theme-developers-told-they-must-use-2fa
  • https://thehackernews.com/2024/09/wordpress-mandates-two-factor.html
• マスターカード Recorded Future を買収
  • https://www.theregister.com/2024/09/12/mastercard_recorded_future/
• Microsoft Windows EDRがカーネルにアクセスする際のデザインを再設計。Crowdstrikeの件により。
  • https://www.securityweek.com/post-crowdstrike-fallout-microsoft-redesigning-edr-vendor-access-to-windows-kernel/
  • https://www.theregister.com/2024/09/13/microsoft_is_updating_windows_to/