Let’s take a look at a brief overview of new cybersecurity solutions from last week. In the spotlight: Chrome, GitHub, Citrix, Cisco, Downfall, Jenkins, Juniper Networks, Ivanti Sentry.
On Monday, the IT software firm rolled out emergency fixes for a severe flaw in the Ivanti Sentry (previously known as MobileIron Sentry) software. This vulnerability, identified as CVE-2023-38035, impacts Ivanti Sentry versions up to 9.18. If exploited, attackers could modify settings, execute system commands, or add files to the system, according to an Ivanti advisory. Hackers could also exploit this flaw to access vital API information and configurations.
Juniper Networks, a producer of networking devices, has unveiled fixes for four bugs in the J-Web interface of Junos OS. These vulnerabilities, ranging from CVE-2023-36844 to CVE-2023-36847, have been labeled as ‘medium’ in severity. However, when exploited in tandem, their impact is deemed to be of ‘critical severity’, as mentioned in a Juniper advisory.
Jenkins, an open-source tool for automating software development, has recently launched patches for significant vulnerabilities affecting various plugins. These patches remedy three major cross-site request forgery (CSRF) and cross-site scripting (XSS) vulnerabilities found in the Folders, Flaky Test Handler, and Shortcut Job plugins.
Numerous leading companies have issued security alerts in light of the newly revealed Intel CPU flaw called Downfall. Identified by experts from Google and cataloged as CVE-2022-40982, Downfall is a technique that leverages side-channel attacks. This method permits local intruders or malware to extract confidential data, such as encryption keys and passwords, from the targeted equipment.
On Wednesday, Cisco introduced security enhancements for multiple corporate software solutions to mend severe vulnerabilities that could lead to privilege elevation, SQL injections, directory traversals, and denial-of-service (DoS) attacks. The most critical among these vulnerabilities affects the web admin interface of Cisco Unified Communications Manager (Unified CM) and its Session Management Edition (Unified CM SME).
Recently, there has been a surge in attempts to exploit a remote execution flaw in Citrix’s ShareFile tool. This uptick coincided with the US Cybersecurity and Infrastructure Security Agency (CISA) listing it in its catalog of Known Exploited Vulnerabilities. Identified as CVE-2023-24489 and labeled ‘critical’, this vulnerability could enable an unauthorized attacker to upload random files, potentially leading to remote execution.
GitHub, a code repository platform owned by Microsoft, declared on Tuesday that between February 2022 and February 2023, they distributed over $1.57 million as part of their bug bounty initiative. Since its inception in 2016 on the HackerOne platform, GitHub has awarded more than $3.8 million in total under this program.
On Tuesday, Google launched Chrome 116 to its stable channel, incorporating fixes for 26 vulnerabilities. Of these, 21 were identified by third-party researchers. Among the vulnerabilities highlighted by external parties, eight were categorized as ‘high’ severity, with a majority linked to memory safety concerns.
