Samba released security update to address several vulnerabilities in samba. Exploitation of this vulnerability may allow a remote attacker to take control of affected systems.
Users and administrators are encouraged to review Samba Security Releases and apply the necessary updates; for more information visit CVE-2018-1050 and CVE-2018-1057
Cisco has released security updates to address vulnerabilities in its multiple products. Exploitation of these vulnerabilities can allow an attacker to take control of an affected system.
Users and administrators are encouraged to review Cisco Security Advisory and apply the necessary updates.
For more information visit:
Drupal has released security updates to address vulnerabilities in Drupal version 7 and 8. Exploitation of these vulnerabilities could potentially allow an attacker to take control of an affected system.
Users and administrators are encouraged to review the Drupal Security Advisory and apply the necessary updates; click here for more information.
Date of First Release: 2018-01-03.
Source: Google, National Cybersecurity and Communications Integration Center (NCCIC).
Product affected:
Modern microprocessors (CPUs) which use speculative execution techniques to optimize performance including AMD, Apple, Arm, Google, Intel, Linux Kernel, Microsoft, Mozilla and other more.
Overview:
CPU hardware implementations are vulnerable to side-channel attacks. These vulnerabilities are also referred as Meltdown and Spectre; they do affect most modern processors (CPUs) which use speculative execution technique to optimize performance.
Description:
The vulnerability is due to improper implementation of the speculative execution of instructions by the affected software. This vulnerability can be triggered by utilizing branch target injection. An attacker could exploit this vulnerability by executing arbitrary code and performing a side-channel attack on a targeted system. A successful exploit could allow the attacker to read sensitive memory information, including accessing memory from the CPU cache.
Variants of this issue are known to affect many modern processors, including certain processors by Intel, AMD and ARM. For a few Intel and AMD CPU models, exploitation has been carried out against real software.
Impact:
A successful exploit could allow attacker to execute arbitrary code with user privileges to achieve various impacts on targeted systems including; gaining access to sensitive information, accessing CPU cache memory and weaken kernel-level protections.
Moreover, further findings have revealed gradual systems performance degradation up to 30 percent as well as availability issues in some cloud services.
Solution:
Users and administrators are encouraged to refer to their OS vendors to avail the most recent information and apply patches. However, it has been established that, in some cases, patching may not fully address these vulnerabilities since they exist in CPU architecture rather than in software. In this regard, replacement of the affected processor with the new one may be deemed necessary in the worst case scenario.
Additionally, users and administrators who rely on cloud infrastructure should work with their service providers to mitigate and resolve any impacts resulting from host operating system patching and mandatory rebooting.
References:
Date of First Release: 10-01-2018
Source: VMware
Product affected:
vSphere Data Protection (VDP) running on the virtual machines Version 6.1.x, 6.0.x and 5.x
Overview:
VSphere Data Protection (VDP) contains multiple authentication bypass, arbitrary file upload and path traversal vulnerabilities.
Description:
VMware has release security advisory to address three critical vulnerabilities in vSphere Data Protection (VDP). The vulnerabilities contains multiple authentication bypass, arbitrary file upload and path traversal and it affects VDP version 5.x, 6.0.x and 6.1.x.
The authentication bypass vulnerability can allow an unauthenticated malicious user to remotely bypass authentication and gain root access to the affected system, arbitrary file upload vulnerability can allow a malicious user with access to a low-privileged account to upload malicious files to any location on the server file system and the path traversal vulnerability can allow a malicious user with low privileges to access arbitrary files on the server in the context of the vulnerable application.
Impact:
The exploitation of the aforementioned vulnerabilities could allow a malicious user to take control of the affected system.
Solution:
User and administrator are advised to review released notes and install recommended patches:
References
Tanzania Computer Emergency Response Team