Debian GNU/Linux 11.3 “Bullseye” Released with 83 Security Updates and 92 Bug Fixes

https://www.debian.org/News/2022/20220326

P.S. I wrote simple noscript for upgrade Debian to latest release and install unattended-upgrades (tested and use on Debian 11):

https://github.com/m0zgen/apt-automatic

/ Resolved RCE in Sophos Firewall (CVE-2022-1040)

An authentication bypass vulnerability allowing remote code execution was discovered in the User Portal and Webadmin of Sophos Firewall and responsibly disclosed to Sophos

https://www.sophos.com/en-us/security-advisories/sophos-sa-20220325-sfos-rce

/ Vidar Malware Launcher Concealed in Help File (CHM)

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/vidar-malware-launcher-concealed-in-help-file/

/ A Beautiful Factory For Malicious Packages

Hundreds of malicious packages attempting to use a dependency confusion attack. The attacker has fully-automated the process of NPM account creation and has open dedicated accounts, one per package, making his new malicious packages batch harder to spot:

https://checkmarx.com/blog/a-beautiful-factory-for-malicious-packages/

/ New Conversation Hijacking Campaign Delivering IcedID

his post describes the technical analysis of a new campaign detected by Intezer’s research team, which initiates attacks with a phishing email that uses conversation hijacking to deliver IcedID.

One way IcedID infects machines is via phishing emails. The infection chain that commonly has been used is an email with an attached password protected “zip” archive. Inside the archive is a macro enabled office document that executes the IcedID installer. Some phishing emails reuse previously stolen emails to make the lure more convincing:

https://www.intezer.com/blog/research/conversation-hijacking-campaign-delivering-icedid/

Notify: One BLD DNS server set to maintenance mode

- this operation can continue 10-20 min
- operation not affect DoT/DoH users

- Mainteained server - 92.63.193.211
- After complete this message will be update to “Done” status

up

Done!

/ Unauthenticated Stack-based Buffer Overflow Vulnerability In Sonicos

Score 9.4 (Sophos was recently)

A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall:

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0003

/ Pwning Microsoft Azure Defender for IoT | Multiple Flaws Allow Remote Code Execution for All

https://www.sentinelone.com/labs/pwning-microsoft-azure-defender-for-iot-multiple-flaws-allow-remote-code-execution-for-all/

/ CVE-2022-22948: Sensitive Information Disclosure in VMware vCenter

https://www.pentera.io/blog/information-disclosure-in-vmware-vcenter/

Hexway — Пентест как сервис
 
Платформа для пентеста и управления аудитами, подходит не только пентестерам, но и багхентерам, CTF игрокам и вообще всем, кто хоть как-то связан с информационной безопасностью.

Бесплатная self-hosted версия, есть некоторые ограничения, но создатели обычно дают подсказку, как их обойти:
- генерить кастомные репорты (еще и соберут ваш собственный шаблон отчетов по запросу)
- интегрироваться с разными сканнерами и тулзами вроде Nmap и Nessus
- собирать кастомные чеклисты
- презентовать результаты через Apiary и еще много всего
- Online-demo Здесь, Self-hosted Здесь

~~ EN
Hexway — Pentest as a service.
Platform for vulnerability assessment and penetration testing.

Free self-hosted version with some restrictions, but developers usually give a hint how to make them unlimited:
- generate custom reports (they also make your personal predefined templates by request)
- integrate with different scanners and tools like Nmap and Nessus
- create custom checklists
- present results via Apiary and much more
- Online-demo Here, Self-hosted Here
 

/ Multiple Vulnerabilities in Schneider Electric APC Smart-UPS Could Allow for Remote Code Execution

https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-schneider-electric-apc-smart-ups-could-allow-for-remote-code-execution_2022-035

CVE-2022-0778

The discovered vulnerability triggers an infinite loop in the function BN_mod_sqrt() of OpenSSL while parsing an elliptic curve key. This means that a maliciously crafted X.509 certificate can DoS any unpatched server.

PoC

https://github.com/drago-96/CVE-2022-0778

/ About the security content of iOS 15.4.1 and iPadOS 15.4.1

Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited

https://support.apple.com/en-gb/HT213219

/ GitLab Accounts Hijacking

Critical Security Release: 14.9.2, 14.8.5, and 14.7.7

We strongly recommend that all GitLab installations be upgraded to one of these versions immediately

https://about.gitlab.com/releases/2022/03/31/critical-security-release-gitlab-14-9-2-released/

/ Detecting Rogue RDP

This post examines signals generated by the attack, outlines detection opportunities, and discusses required sysmon configuration changes.

https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/