Advisories

1.0 Introduction

On Nov. 14, 2023, Adobe released security updates addressing vulnerabilities affecting unpatched ColdFusion software.

2.0 Impact
Exploitation of some of these vulnerabilities may allow a malicious cyber actor to take control of an affected system.

3.0 Affected Products

4.0 Recommendations
MyCERT urges organizations to review Adobe ColdFusion security bulletin APSB23-52 for more information and to:

• Apply the recommended updates in APSB23-52.
• Follow Adobe recommendations on ColdFusion hardening.? 
  • ColdFusion 2023 Lockdown Guide
  • ColdFusion 2021 Lockdown Guide
• Consider adding a web application firewall (WAF) filter for CFIDE for external users.

Kindly visit https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html for more information.

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
• https://www.cisa.gov/news-events/alerts/2023/11/22/adobe-releases-security-updates-coldfusion

1.0 Introduction

Recently, Mozilla has released security updates to address vulnerabilities in Firefox and Thunderbird.

2.0 Impact
A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.

3.0 Affected Products

• Firefox iOS
• Firefox
• Firefox ESR
• Thunderbird

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates:

• Firefox iOS 120 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-51/
• Firefox 120 -  https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/
• Firefox ESR 115.5 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-50/
• Thunderbird 115.5.0 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-52/

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• Firefox iOS 120 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-51/
• Firefox 120 -  https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/
• Firefox ESR 115.5 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-50/
• Thunderbird 115.5.0 - https://www.mozilla.org/en-US/security/advisories/mfsa2023-52/
• https://www.cisa.gov/news-events/alerts/2023/11/22/mozilla-releases-security-updates-firefox-and-thunderbird

1.0 Introduction

Recently, VMware has released a security advisory addressing a vulnerability in VMWare Cloud Director Appliance. 

2.0 Impact
Cyber threat actors may exploit this vulnerability to take control of an affected system.

3.0 Affected Products
VMware Cloud Director Appliance (VCD Appliance)

4.0 Recommendations
MyCERT encourages users and administrators to review the following VMware security advisory and apply the recommended updates:

• VMSA-2023-0026: VMware Cloud Director Appliance contains an authentication bypass vulnerability (CVE-2023-34060) : https://www.vmware.com/security/advisories/VMSA-2023-0026.html

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/alerts/2023/11/14/vmware-releases-security-update-cloud-director-appliance
• https://www.vmware.com/security/advisories/VMSA-2023-0026.html

1.0 Introduction

Recently, Fortinet has released security advisories addressing vulnerabilities in FortiClient and FortiGate.

2.0 Impact
Cyber threat actors may exploit some of these vulnerabilities to take control of an affected system.

3.0 Affected Products
Fortinet FortiClient and FortiGate.

4.0 Recommendations
MyCERT encourages users and administrators to review the following Fortinet security advisories and apply the recommended updates:

• FG-IR-22-299: FortiClient (Windows) - Arbitrary file deletion from unprivileged users : https://www.fortiguard.com/psirt/FG-IR-22-299
• FG-IR-23-274: FortiClient (Windows) - DLL Hijacking via openssl.cnf : https://www.fortiguard.com/psirt/FG-IR-23-274
• FG-IR-23-385: curl and libcurl CVE-2023-38545 and CVE-2023-38546 vulnerabilities : https://www.fortiguard.com/psirt/FG-IR-23-385

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• FG-IR-22-299: FortiClient (Windows) - Arbitrary file deletion from unprivileged users
• FG-IR-23-274: FortiClient (Windows) - DLL Hijacking via openssl.cnf
• FG-IR-23-385: curl and libcurl CVE-2023-38545 and CVE-2023-38546 vulnerabilities
• https://www.cisa.gov/news-events/alerts/2023/11/14/fortinet-releases-security-updates-forticlient-and-fortigate

1.0 Introduction

Recently, Microsoft has released updates addressing multiple vulnerabilities in Microsoft software.

2.0 Impact
A cyber threat actor can exploit some of these vulnerabilities to take control of an affected system.

3.0 Affected Products
Multiple Microsoft Windows and Software

4.0 Recommendations
MyCERT encourages users and administrators to review Microsoft’s November 2023 Security Update Guide and apply the necessary updates.

Kindly refer to the URL for more information: https://msrc.microsoft.com/update-guide/releaseNote/2023-Nov

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://www.cisa.gov/news-events/alerts/2023/11/14/microsoft-releases-november-2023-security-updates
• https://msrc.microsoft.com/update-guide/releaseNote/2023-Nov

1.0 Introduction

Recently, Adobe has released security updates to address vulnerabilities affecting multiple Adobe products.

2.0 Impact
A cyber threat actor could exploit some of these vulnerabilities to take control of affected system.

3.0 Affected Products

• Adobe ColdFusion
• Adobe RoboHelp Server
• Adobe Acrobat and Reader
• Adobe InDesign
• Adobe Photoshop
• Adobe Bridge
• Adobe FrameMaker Publishing Server
• Adobe InCopy
• Adobe Animate
• Adobe Dimension
• Adobe Media Encoder
• Adobe Audition
• Adobe Premiere Pro
• Adobe After Effects

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates.

• APSB23-52: Adobe ColdFusion
• APSB23-53: Adobe RoboHelp Server
• APSB23-54: Adobe Acrobat and Reader
• APSB23-55: Adobe InDesign
• APSB23-56: Adobe Photoshop
• APSB23-57: Adobe Bridge
• APSB23-58: Adobe FrameMaker Publishing Server
• APSB23-60: Adobe InCopy
• APSB23-61: Adobe Animate
• APSB23-62: Adobe Dimension
• APSB23-63: Adobe Media Encoder
• APSB23-64: Adobe Audition
• APSB23-65: Adobe Premiere Pro
• APSB23-66: Adobe After Effects

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References
https://www.cisa.gov/news-events/alerts/2023/11/14/adobe-releases-security-updates-multiple-products

1.0 Introduction

Recently, Cisco released security advisories for vulnerabilities affecting multiple Cisco products.

2.0 Impact
A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system.

3.0 Affected Products

• Cisco Firepower Management Center Software
• Cisco Identity Services Engine
• Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series Firewalls
• Cisco Firepower Threat Defense Software
• Cisco Firepower Threat Defense Software and Firepower Management Center Software 
• Cisco Firepower Management Center Software
• Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software 

4.0 Recommendations
MyCERT encourages users and administrators to review the following advisories and apply the necessary updates:

• Cisco Firepower Management Center Software Command Injection Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-29MP49hN
• Cisco Identity Services Engine Command Injection Vulnerabilities - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-injection-QeXegrCw
• Cisco Identity Services Engine Vulnerabilities - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-file-upload-FceLP4xs
• Cisco Firepower Threat Defense Software for Cisco Firepower 2100 Series Firewalls Inspection Rules Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-intrusion-dos-DfT7wyGC
• Cisco Firepower Threat Defense Software ICMPv6 with Snort 2 Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-icmpv6-dos-4eMkLuN
• Cisco Firepower Threat Defense Software and Firepower Management Center Software Code Injection Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ftd-fmc-code-inj-wSHrgz8L
• Cisco Firepower Management Center Software Log API Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-logview-dos-AYJdeX55
• Cisco Firepower Management Center Software Command Injection Vulnerabilities - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmdinj-bTEgufOX
• Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Remote Access VPN Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-webvpn-dos-3GhZQBAS
• Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software ICMPv6 Message Processing Denial of Service Vulnerability - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-icmpv6-t5TzqwNd

For updates addressing lower severity vulnerabilities, see the Cisco Security Advisories page.

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References
https://www.cisa.gov/news-events/alerts/2023/11/03/cisco-releases-security-advisories-multiple-products

1.0 Introduction

MyCERT has observed a critical vulnerability in the F5 BIG-IP product that could be exploited to execute malicious code on vulnerable systems.

The F5 BIG-IP Configuration Utility contains an unauthenticated remote code execution (RCE) vulnerability that allows an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands. The vulnerability is caused by an improper authentication mechanism in the Configuration Utility.

2.0 Impact
Successful exploitation could allow a threat actor to execute arbitrary system commands on the BIG-IP system by sending specially crafted HTTP requests to the BIG-IP system.

3.0 Affected Products

• BIG-IP (all modules)
  • 17.1.0
  • 16.1.0 - 16.1.4
  • 15.1.0 - 15.1.10
  • 14.1.0 - 14.1.5
  • 13.1.0 - 13.1.5

4.0 Recommendations
MyCERT recommends upgrading affected versions to the fixed or most recent version released by F5. Kindly refer to the following link for more information:
https://my.f5.com/manage/s/article/K000137353

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• https://my.f5.com/manage/s/article/K000137353
• https://www.cisa.gov/news-events/alerts/2023/10/31/cisa-adds-two-known-exploited-vulnerabilities-catalog

1.0 Introduction

Recently, Microsoft has released updates to address multiple vulnerabilities in Microsoft software.

2.0 Impact
A cyber threat actor can exploit some of these vulnerabilities to take control of an affected system.

3.0 Affected Products
Multiple Microsoft software/products and Windows Operating Systems

4.0 Recommendations
MyCERT encourages users and administrators to review Microsoft’s October 2023 Security Update Guide and apply the necessary updates. Kindly refer to the following link:
https://msrc.microsoft.com/update-guide/releaseNote/2023-oct

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References

• October 2023 Security Updates - Release Notes - Security Update Guide - Microsoft
• Microsoft Releases October 2023 Security Updates | CISA

1.0 Introduction

Recently, Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.

2.0 Impact
This recently disclosed vulnerability affects certain versions of Atlassian Confluence Data Center and Server, enabling malicious cyber threat actors to obtain initial access to Confluence instances by creating unauthorized Confluence administrator accounts. Threat actors exploited CVE-2023-22515 as a zero-day to obtain access to victim systems and continue active exploitation post-patch.

Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

3.0 Affected Products
The Confluence Data Center and Server versions listed below are affected by this vulnerability. Customers using these versions should upgrade your instance as soon as possible.

Versions prior to 8.0.0 are not affected by this vulnerability.

Atlassian recommends that you upgrade each of your affected installations to one of the listed fixed versions (or any later version) below.

For a full description of the latest versions of Confluence Data Center and Confluence Server, see the release notes, here. You can download the latest version from the download center, here.

4.0 Recommendations
4.1 Upgrade to a fixed version. (See: Upgrade Instructions)

Customers with Confluence Data Center and Server instances accessible to the public internet including with user authentication, should restrict external network access until you can upgrade.

If you cannot restrict external network access before your upgrade, apply the following interim measures to mitigate known attack vectors by blocking access to the /setup/* endpoints on Confluence instances. This is possible at the network layer or by making the following changes to Confluence configuration files.

• On each node, modify /<confluence-install-dir>/confluence/WEB-INF/web.xml  and add the following block of code (just before the </web-app> tag at the end of the file):
  • <security-constraint>      <web-resource-collection>        <url-pattern>/setup/*</url-pattern> <http-method-omission>*</http-method-omission> </web-resource-collection>      <auth-constraint /> </security-constraint>
• Restart Confluence.

This action will block access to setup pages that are not required for typical Confluence usage, for further details see the FAQ page below.

Note: These mitigation actions are limited and not a replacement for upgrading your instance; you must upgrade as soon as possible.

4.2 Threat detection

Atlassian cannot confirm if your instances have been affected by this vulnerability. Work with your security team to check all affected Confluence instances for evidence of compromise, as outlined below. If any evidence is found, you should assume that your instance has been compromised and evaluate the risk of flow-on effects. If your Confluence instances have been compromised, these threat attackers hold full administrative access and can perform any number of unfettered actions including - but not limited to - exfiltration of content and system credentials, and installation of malicious plugins.

Evidence of compromise may include:

• unexpected members of the confluence-administrators group
• unexpected newly created user accounts
• requests to /setup/*.action in network access logs
• presence of /setup/setupadministrator.action in an exception message in atlassian-confluence-security.log in the Confluence home directory

If you believe you were compromised, please raise a support request as Atlassian assistance is required to recover and protect your instance.

Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.

For further enquiries, please contact MyCERT through the following channels:

E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: https://www.mycert.org.my 
Twitter: https://twitter.com/mycert 
Facebook: https://www.facebook.com/mycert.org.my

5.0    References
[1]   Atlassian: CVE-2023-22515 - Broken Access Control Vulnerability in Confluence Data Center and Server
[2]   Rapid7: CVE-2023-22515 Analysis
[3]   Microsoft: CVE-2023-22515 Exploit IP Addresses
[4]   Proofpoint: Emerging Threats Rulesets
[5]   Confluence CVE-2023-22515 Proof of Concept - vulhub
[6]   Atlassian Support: Upgrading Confluence