blog sistemITecblog sistemITec

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    What's Hot

    Schedule a job on Aruba Switch

    July 5, 2023

    How to decrypt and verify text or files with GPG Services

    June 28, 2023

    How to send WhatsApp messages to someone without saving their phone number

    June 19, 2023
    Facebook X (Twitter) Instagram
    • sistemITec website
    • contact us
    Facebook Instagram YouTube LinkedIn
    blog sistemITecblog sistemITec
    • IT Fundamentals
        Featured
        IT Fundamentals

        How to send WhatsApp messages to someone without saving their phone number

        By Cornel CabaJune 19, 20230
        Recent

        How to send WhatsApp messages to someone without saving their phone number

        June 19, 2023

        Network Topology Guide

        June 19, 2023

        Top 20 Essential ESXCLI Commands

        June 19, 2023
      1. Gaming
          Featured
          Gaming

          Application load error 5:0000065434 in Steam

          By sistemitec's teamAugust 8, 20210
          Recent

          Application load error 5:0000065434 in Steam

          August 8, 2021

          The Best Overlooked Video Game Of 2020

          August 2, 2021

          Hearts of Iron IV Review

          August 2, 2021
        1. Software
            Featured
            Software

            Schedule a job on Aruba Switch

            By Cornel CabaJuly 5, 20230
            Recent

            Schedule a job on Aruba Switch

            July 5, 2023

            How to decrypt and verify text or files with GPG Services

            June 28, 2023

            Windows Server 2019/ Product Key Free

            June 19, 2023
          1. Gadgets
              Featured
              Gadgets

              How to Simulate Arduino Projects With Proteus

              By Cornel CabaMarch 17, 20220
              Recent

              How to Simulate Arduino Projects With Proteus

              March 17, 2022

              How connect Apple AirPods to a Windows PC

              February 10, 2022

              How to Put Ebooks on Amazon Kindle

              October 12, 2021
            1. Tech
                Featured
                Tech

                Lenovo Unveils IdeaPad Laptops, 5G Internet & a Snapdragon 8cx Chipset

                By Cornel CabaJanuary 15, 20210
                Recent

                Lenovo Unveils IdeaPad Laptops, 5G Internet & a Snapdragon 8cx Chipset

                January 15, 2021

                2021 Apple MacBook Air: Apples New Leak Reveals Razor-thin Redesign

                January 15, 2021
                8.9

                Review: Xiaomi’s New Loudspeakers for Hi-fi and Home Cinema Systems

                January 15, 2021
              blog sistemITecblog sistemITec
              Home»Software»3 Severe Security Vulnerabilities Found In SolarWinds Software
              Software

              3 Severe Security Vulnerabilities Found In SolarWinds Software

              sistemitec's teamBy sistemitec's teamAugust 4, 2021No Comments4 Mins Read
              Facebook Twitter Pinterest LinkedIn Tumblr Email
              Share
              Facebook Twitter LinkedIn Pinterest Email

              Cybersecurity researchers on Wednesday disclosed three severe security vulnerabilities impacting SolarWinds products, the most severe of which could have been exploited to achieve remote code execution with elevated privileges.

              Two of the flaws (CVE-2021-25274 and CVE-2021-25275) were identified in the SolarWinds Orion Platform, while a third separate weakness (CVE-2021-25276) was found in the company’s Serv-U FTP server for Windows, said cybersecurity firm Trustwave in a technical analysis.

              None of the three vulnerabilities are believed to have been exploited in any “in the wild” attacks or during the unprecedented supply chain attack targeting the Orion Platform that came to light last December.

              The two sets of vulnerabilities in Orion and Serv-U FTP were disclosed to SolarWinds on December 30, 2020, and January 4, 2021, respectively, following which the company resolved the issues on January 22 and January 25.

              It’s highly recommended that users install the latest versions of Orion Platform and Serv-U FTP (15.2.2 Hotfix 1) to mitigate the risks associated with the flaws. Trustwave said it intends to release a proof-of-concept (PoC) code next week on February 9.

              Complete Control Over Orion

              Chief among the vulnerabilities uncovered by Trustwave includes improper use of Microsoft Messaging Queue (MSMQ), which is used heavily by the SolarWinds Orion Collector Service, thereby allowing unauthenticated users to send messages to such queues over TCP port 1801 and eventually attain RCE by chaining it with another unsafe deserialization issue in the code that handles incoming messages.

              “Given that the message processing code runs as a Windows service configured to use LocalSystem account, we have complete control of the underlying operating system,” Trust researcher Martin Rakhmanov said.

              The patch released by SolarWinds (Orion Platform 2020.2.4) addresses the bug with a digital signature validation step that’s performed on arrived messages to ensure that unsigned messages are not processed further, but Rakhmanov cautioned that the MSMQ is still unauthenticated and allows anyone to send messages to it.

              The second vulnerability, also found in the Orion Platform, concerns the insecure manner in which credentials of the backend database (named “SOLARWINDS_ORION”) is stored in a configuration file, resulting in a local, unprivileged user take complete control over the database, steal information, or even add a new admin-level user to be used inside SolarWinds Orion products.

              Lastly, a flaw in SolarWinds Serv-U FTP Server 15.2.1 for Windows could allow any attacker that can log in to the system locally or via Remote Desktop to drop a file that defines a new admin user with full access to the C:\ drive, which can then be leveraged by logging in as that user via FTP and read or replace any file on the drive.

              U.S. Department of Agriculture Targeted Using New SolarWinds Flaw

              News of the three vulnerabilities in SolarWinds products comes on the heels of reports that alleged Chinese threat actors exploited a previously undocumented flaw in the company’s software to break into the National Finance Center, a federal payroll agency inside the U.S. Department of Agriculture.

              This flaw is said to be different from those that were abused by suspected Russian threat operatives to compromise SolarWinds Orion software that was then distributed to as many as 18,000 of its customers, according to Reuters.

              In late December, Microsoft said a second hacker collective might have been abusing the IT infrastructure provider’s Orion software to drop a persistent backdoor called Supernova on target systems by taking advantage of an authentication bypass vulnerability in the Orion API to execute arbitrary commands.

              SolarWinds issued a patch to address the vulnerability on December 26, 2020.

              Last week, Brandon Wales, acting director of the U.S. Cybersecurity and Infrastructure Agency (CISA), said nearly 30% of the private-sector and government agencies linked to the intrusion campaign had no direct connection to SolarWinds, implying that the attackers used a variety of ways to breach target environments.

              The overlap in the twin espionage efforts notwithstanding, the campaigns are yet another sign that advanced persistent threat (APT) groups are increasingly focusing on the software supply chain as a conduit to strike high-value targets such as corporations and government agencies.

              The trust and ubiquity of software such as those from SolarWinds or Microsoft make them a lucrative target for attackers, thus underscoring the need for organizations to be on the lookout for potential dangers stemming from relying on third-party tools to manage their platforms and services.

              security solarwinds vulnerabilities
              Share. Facebook Twitter Pinterest LinkedIn Tumblr Email
              Previous Article2-Factor Authentication Bypass Flaw in cPanel and WHM Software
              Next Article What you should know about DuckDuckGo SEO
              sistemitec's team

                Related Posts

                Schedule a job on Aruba Switch

                July 5, 2023

                How to decrypt and verify text or files with GPG Services

                June 28, 2023

                Windows Server 2019/ Product Key Free

                June 19, 2023

                Sysprep Windows 10 and 11 Machine: Step by Step Guide

                June 19, 2023
                Add A Comment

                Leave A Reply Cancel Reply

                Editors Picks

                Shrinking VMDK Virtual Disk Size on VMWare ESXi

                August 11, 2022

                Oculus Quest X Headset: Discover a Shining New Star

                January 5, 2021

                iPhone Pro 13 Rumored to Feature 1 TB of Storage

                January 5, 2021

                Fujifilm’s 102-Megapixel Camera is the Size of a Typical DSLR

                January 5, 2021
                Top Reviews
                9.1

                Review: Mi 10 Mobile with Qualcomm Snapdragon 870 Mobile Platform

                By Cornel Caba
                8.9

                Review: Xiaomi’s New Loudspeakers for Hi-fi and Home Cinema Systems

                By Cornel Caba
                8.9

                Comparison of Mobile Phone Providers: 4G Connectivity & Speed

                By Cornel Caba
                Advertisement
                © 2023 sistemITec. Designed by Cornel Caba.
                • sistemITec.com
                • cornelcaba.com

                Type above and press Enter to search. Press Esc to cancel.