dcsimg

IT Security Vulnerability Roundup – December 2018

SHARE
Share it on Twitter  
Share it on Facebook  
Share it on Linked in  
Email  

Every month sees the disclosure of a flood of new vulnerabilities, and it can be a challenge to keep up. Below, we look at 10 security flaws disclosed within the past few weeks.

1. SQL Injection Vulnerability in Cisco Prime License Manager

CVE identifier: CVE-2018-15441

CVSS Base Score: 9.4

The vulnerability: A flaw in the Web framework code of Cisco Prime License Manager (PLM), due to a lack of proper validation of user-supplied input in SQL queries, could allow an unauthenticated remote attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgresuser.

The fix: Cisco has released software updates that address the vulnerability.

More info: The vulnerability was reported to Cisco by security researcher Suhail Alaskar of Saudi Information Technology Company. Cisco has details on the flaw here.

2. Privilege Escalation Vulnerability in Kubernetes

CVE identifier: CVE-2018-1002105

CVSS Base Score: 9.8

The vulnerability: A vulnerability in all Kubernetes versions prior to 1.10.11, 1.11.5 and 1.12.3 could allow an unauthenticated user to gain full admin privileges.

The fix: Updates have been released to patch the flaw.

More info: The vulnerability was discovered by Rancher co-founder and chief architect Darren Shepherd, who has more information here. NIST has details here.

3. Default Account Flaw in Safe Software FME Server

CVE identifier: CVE-2018-20401

CVSS Base Score: 9.8

The vulnerability: Default hardcoded credentials (for author, guest and user accounts) in Safe Software FME Server could provide an attacker with access to the system.

The fix: No fix was available at the time of publication.

More info: IBM X-Force Exchange has more information here.

4. Command Injection Vulnerabilities in ASUSTOR ADM

CVE identifiers: CVE-2018-12307, CVE-2018-12312, CVE-2018-12313, CVE-2018-12316, CVE-2018-12317

CVSS Base Scores: 9.0, 9.0, 10.0, 9.0, 9.0

The vulnerability: Four separate OS command injection flaws in ASUSTOR ADM v3.1.1 could allow attackers to execute system commands as root, and a fifth OS command injection flaw (CVE-2018-12313) could allow attackers to execute system commands without authentication.

The fix: ASUSTOR has released firmware version ADM 3.1.3.RHU2 to patch the flaws.

More info: The flaws were disclosed by ISE Labs, which has more information on them here.

5. Command Injection Vulnerabilities in Drobo 5N2

CVE identifiers:CVE-2018-14699, CVE-2018-14701, CVE-2018-14706

CVSS Base Scores: 7.5, 7.5, 10.0

The vulnerability: Two separate command injection flaws affecting the DroboAccess Web application, and a third command injection flaw in the optional DroboPix application, could allow an unauthenticated attacker to execute system commands.

The fix: The flaws affect Drobo 5n2 firmware 4.0.5-13.28-96115. It's not clear if the latest firmware release, 4.1.2-13.35-105624, patches the vulnerabilities.

More info: The flaws were disclosed by ISE Labs, which has more information on them here.

6. Several Vulnerabilities in Synology DiskStation Manager (DSM)

CVE identifiers: CVE-2018-8917, CVE-2018-8919, CVE-2018-8920

CVSS Base Scores: 6.5,8.3, 5.9

The vulnerabilities: A cross-site scripting vulnerability in Synology DSM could allow remote attackers to inject arbitrary Web script or HTML; aflaw in SYNO-Core.Desktop.SessionData could allow a remote attacker to steal credentials; and a vulnerability in Log Exporter in DSM could allow a remote attacker to inject arbitrary content.

The fix: Synology has released updates and workarounds to address the vulnerabilities.

More info: Synology has details here.

7. Privilege Escalation Vulnerability in Cisco ASA Software

CVE identifier: CVE-2018-15465

CVSS Base Score: 8.1

The vulnerability: A vulnerability in the authorization subsystem of Cisco Adaptive Security Appliance (ASA) Software, due to improper validation of user privileges when using the Web management interface, could allow an authenticated but unprivileged attacker to perform privileged actions such as retrieving files or uploading and replacing software images on the device.

The fix: Cisco has released software updates to address the vulnerability.

More info: The vulnerability was reported to Cisco by Ken Johnson of Tenable, Inc. Cisco has details on the flaw here.

8. Privilege Escalation Vulnerabilities in Windows

CVE identifiers: CVE-2018-8611, CVE-2018-8639, CVE-2018-8641

CVSS Base Scores: 7.8, 7.8, 7.8

The vulnerabilities: Flaws in the way the Windows kernel and the Win32k component handle objects in memory could allow an attacker to run arbitrary code in kernel mode, allowing the attacker to install programs; view, change or delete data; or create new accounts with full user rights.

The fix: Microsoft has released software updates to address the vulnerabilities.

More info: The vulnerabilities were reported to Igor Soumenkov and Boris Larin of Kaspersky Lab. Microsoft has details herehere and here; and Kaspersky has more information here.

9. D-Link Information Disclosure Vulnerabilities

CVE identifiers: CVE-2018-20389,CVE-2018-20445

CVSS Base Scores: 7.5, 7.5

The vulnerabilities: Specially crafted SNMP requests could allow a remote attacker to obtain sensitive information from the D-Link DCM-604 and DCM-704.

The fix: No fix was available at the time of publication.

More info: IBM X-Force Exchange has details here and here.

10. Orange Livebox Information Disclosure Vulnerability

CVE identifier: CVE-2018-20377

CVSS Base Score: 7.5

The vulnerability: A flaw in the get_getnetworkconf.cgi script could allow a remote attacker to obtain sensitive information.

The fix: No fix was available at the time of publication.

More info: IBM X-Force Exchange has details here.

 

Looking for more? Last month’s vulnerability roundup can be found here.

Submit a Comment

Loading Comments...