A out-of-bounds write in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.10, FortiOS version 6.4.0 through 6.4.11, FortiOS version 6.2.0 through 6.2.13, FortiOS all versions 6.0,  FortiProxy version 7.2.0 through 7.2.1, FortiProxy version 7.0.0 through 7.0.7, FortiProxy all versions 2.0, FortiProxy all versions 1.2, FortiProxy all versions 1.1, FortiProxy all versions 1.0 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted requests.

** PSIRT Advisories**

**FortiOS & FortiProxy - Out-of-bound-write in sslvpnd**

**Summary**

An out-of-bounds write vulnerability \[CWE-787\] in sslvpnd of FortiOS and FortiProxy may allow an authenticated attacker to achieve arbitrary code execution via specifically crafted requests.

**Affected Products**

FortiOS version 7.2.0 through 7.2.3  
FortiOS version 7.0.0 through 7.0.10  
FortiOS version 6.4.0 through 6.4.11  
FortiOS version 6.2.0 through 6.2.13  
FortiOS 6.0 all versions  
FortiProxy version 7.2.0 through 7.2.1  
FortiProxy version 7.0.0 through 7.0.7  
FortiProxy all versions 2.0, 1.2, 1.1, 1.0

**Solutions**

Please upgrade to FortiOS version 7.4.0 or above  
Please upgrade to FortiOS version 7.2.4 or above  
Please upgrade to FortiOS version 7.0.11 or above  
Please upgrade to FortiOS version 6.4.12 or above  
Please upgrade to FortiOS version 6.2.14 or above  
Please upgrade to FortiProxy version 7.2.2 or above  
Please upgrade to FortiProxy version 7.0.8 or above

Workaround:

Disable "Host Check", "Restrict to Specific OS Versions" and "MAC address host checking" in sslvpn portal configuration. For example for "full-access" sslvpn portal:

config vpn ssl web portal  
edit "full-access"  
set os-check disable  
set host-check none  
set mac-addr-check disable  
end

**Acknowledgement**

Internally discovered and reported by Gwendal Guégniaud of Fortinet Product Security team in the frame of an internal audit of the SSL-VPN component.

**Timeline**

2023-04-13: Initial publication

CVE-2023-22640: Fortiguard

The Databricks Platform as of 2023-01-26 suffered from a cluster isolation bypass vulnerability through insecure defaults and shared storage.

Databricks Platform Cluster Isolation Bypass

Categories: News
Google has promised to add end-to-end encryption to Google Authenticator backups after users were warned against turning on the new feature.



(Read more...)




The post Google Authenticator WILL get end-to-end encryption. Eventually. appeared first on Malwarebytes Labs.

Following criticism, Google has decided to bring end-to-end encryption (E2EE) to its Google Authenticator cloud backups. The search giant recently introduced a feature that allows users back up two-factor authentication (2FA) tokens to the cloud, but the lack of encryption caused some commentators to warn people off using it.

Google Authenticator is an authenticator app used to generate access codes, called one-time passwords (OTPs). These OTPs are only valid for a short period and are generated on demand. They serve as an additional form of authentication by proving that you have access to the device generating the OTP. Google Authenticator is one of the most well-known authenticators. Although it's made by Google it's not limited to Google’s own services, but can also be used with Facebook, Twitter, Instagram, and many more.

On April 24, 2023, Google announced an update across both iOS and Android, which added the ability to safely backup the secrets used to generate OTPs to your Google Account. This allows users to create a backup which they can use if their device is lost, stolen, or damaged. Since OTPs in Google Authenticator were previously only stored on a single device, a loss of that device locked you out of any service where you used it to log in.

Shortly after the new feature was rolled out, Mysk’s security researchers advised against turning on the new feature. They analyzed the network traffic that occurs when the app syncs the secrets, and found out that the traffic was not end-to-end encrypted. This would mean that in case of a data breach or if someone obtains access to your Google Account, all of your OTP secrets would be compromised, and they would be able to generate OTPs as if they were you.

The likelihood of someone stealing the secret seeds from Google’s servers is relatively small, but since it is better to be safe than sorry and one problem less is always good to have, users asked Google to add a passphrase to protect the secrets. This would introduce an extra safeguard that makes them accessible only to their owner.

Google’s primary objection to this method was that it heightens the risk of users getting completely locked out of their own data. Meaning that if you lost your device and the passphrase, you would lose all access to your accounts.

Google Group Product Manager Christiaan Brand tweeted that end-to-end encryption (E2EE) will be made available for Google Authenticator down the line, but they are rolling out this feature carefully.

> (2/4) We encrypt data in transit, and at rest, across our products, including in Google Authenticator. E2EE is a powerful feature that provides extra protections, but at the cost of enabling users to get locked out of their own data without recovery.
> 
> — Christiaan Brand (@christiaanbrand) April 26, 2023

According to Google, the option to use the app offline will remain an alternative for those who prefer to manage their backup strategy themselves. But, if you want to try the new Authenticator with Google Account synchronization, simply update the app and follow the prompts.

Malwarebytes removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

Google Authenticator WILL get end-to-end encryption. Eventually.

The tech industry’s transition to passkeys gets its first massive boost with the launch of the alternative login scheme for Google’s billions of users.

Google is announcing a major effort to let its account holders log in with the password replacement known as “passkeys.” The feature launches today for the company's billions of accounts, and users will be able to proactively seek it out and turn it on. Google says it plans to promote passkeys in the coming months and start nudging account holders to convert their traditional username and password login to a passkey.

Password-based authentication has been standard across the internet (and computing in general) for decades, but the system has serious security issues, namely that attackers can steal your password or trick you into giving it to them in phishing attacks. The passkey scheme is specifically designed to address phishing attacks by relying on a different model that uses cryptographic keys stored on your devices for account authentication. 

In the year since the industry association known as the FIDO Alliance began publicly promoting the rollout of passkeys, the makers of the world's biggest consumer operating systems—Microsoft, Google, and Apple—have launched the necessary infrastructure to support passkeys. But if you still have never used a passkey in your daily life, you're far from alone.

The next step toward passkey adoption is for services to actually offer passkeys as a login option for user accounts. So far, companies like PayPal, Shopify, CVS Health, Kayak, and Hyatt have taken the plunge. Today's launch of passkeys for Google’s users is noteworthy given the company's resources and sheer scale.

“It's very, very significant,” says Andrew Shikiar, executive director of the FIDO Alliance. “It's an inflection point. A company like Google enabling this with so many people actually seeing passkey sign-ins, they’ll be more likely to use them elsewhere. And it will also accelerate other companies’ deployment plans and help them deploy better, because we will learn from this as a body."

You can log in with passkeys using biometric sensors like fingerprint or face scanners, your smartphone's device lock PIN, or physical authentication dongles like YubiKeys. To transition your Google account, you'll navigate to this link, log in with your username, password, and any additional authentication factors you have set up, and then click “+ Create a passkey” on the device you're using.

“We have an opportunity here to change the way users think about signing in,” says Christiaan Brand, an identity and security product manager at Google and co-chair of the FIDO2 technical working group. “If we can change the way that signing in works for your Google account, we hope that consumers will start to get more accustomed to the technology, and also signal to industry that we’re not just _talking_ about this stuff—it is ready for prime-time adoption.”

Passkeys can sync between your devices through end-to-end encrypted services like Google Password Manager and iCloud Keychain. Or you can set up passkeys on multiple devices by generating a QR code on a device that's logged in to your Google account that will anoint another device where you want to log in. 

All of your Google account passkeys will be listed on the “Passkey Management Page,” where you can review and revoke them. You can even store a passkey for your account on the device of someone you trust as a recovery option. If you issue a passkey to log into your Google account on a shared device, be sure to revoke it once you're done.

“What doesn’t help is when a vendor or developer only rolls out passkey for iOS or only rolls it out for Android. That’s not how passwords work; passwords are ubiquitous," Brand says. “So for us, it was important to cover as wide a range of devices as possible on launch day, no carve-outs.”

Google says that even once you make a passkey for your account (or five), your traditional username and password login isn't going anywhere, and you can still use it if you choose. But the company is betting that once people get used to passkeys, they'll like them better and find them easier to manage than passwords. And once you've set up a passkey on a device, Google will automatically detect it and prompt you to log in that way going forward.

Brand says that in early tests on a few thousand users, sign-in success rates with passkeys were immediately higher than for traditional username and password logins. That doesn't mean there won't be what Brand calls “rough edges” or use cases where there are passkey bugs. But Google says it hopes to discover and iron out as many of these issues as possible, so smaller organizations can feel more confident implementing passkeys.

Google's announcement comes on the eve of World Password Day on Thursday. But passkey proponents are ramping up their efforts to make the occasion obsolete.

“Eventually, it's going to be like World Horse and Buggy Day, I think,” Shikiar says. “For the time being, it’s a good reminder of the challenge we have to get rid of passwords.”

Google Is Rolling Out Passkeys, the Password-Killing Tech, to All Accounts

Apple and Google have teamed up to work on a draft industry-wide specification that's designed to tackle safety risks and alert users when they are being tracked without their knowledge or permission using devices like AirTags.
"The first-of-its-kind specification will allow Bluetooth location-tracking devices to be compatible with unauthorized tracking detection and alerts across Android and

Apple and Google have teamed up to work on a draft industry-wide specification that's designed to tackle safety risks and alert users when they are being tracked without their knowledge or permission using devices like AirTags.

"The first-of-its-kind specification will allow Bluetooth location-tracking devices to be compatible with unauthorized tracking detection and alerts across Android and iOS platforms," the companies said in a joint statement.

While these trackers are primarily designed to keep tabs on personal belongings like keys, wallets, luggage, and other items, such devices have also been abused by bad actors for criminal or nefarious purposes, including instances of stalking, harassment, and theft.

The goal is to standardize the alerting mechanisms and minimize opportunities for misuse across Bluetooth location-tracking devices from different vendors. To that end, Samsung, Tile, Chipolo, eufy Security, and Pebblebee have all come on board.

In doing so, tracking devices manufactured by the companies are required to adhere to a set of instructions and recommendations as well as notify users of any unauthorized tracking on iOS and Android devices.

"Formalizing a set of best practices for manufacturers will allow for scalable compatibility with unwanted tracking detection technologies on various smartphone platforms and improve privacy and security for individuals," according to the spec.

"Unwanted tracking detection can both detect and alert individuals that a location tracker separated from the owner's device is traveling with them, as well as provide means to find and disable the tracker."

A crucial aspect of the proposed specification is the use of a pairing registry, which contains verifiable (but obfuscated) identity information of the owner of an accessory (e.g., phone number or email address) along with the serial number of the accessory.

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

Besides retaining the data for a period of minimum 25 days after the device has been unpaired (at which point it's deleted), the pairing registry is made available to law enforcement upon submitting a valid request.

The companies are soliciting feedback from interested parties, following which a production implementation of the specification for unwanted tracking alerts is expected to be released sometime by the end of the year on both mobile ecosystems.

The last time Apple and Google came together, it was to devise a system-level platform that utilizes Bluetooth low energy (BLE) beacons to allow for contact tracing during the COVID-19 pandemic without using location data.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Apple and Google Join Forces to Stop Unauthorized Tracking Alert System

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.

**RosarioSIS vulnerable to CSV Injection**

High severity GitHub Reviewed Published May 2, 2023 to the GitHub Advisory Database • Updated May 2, 2023

GHSA-f8hp-grmr-pp7j: RosarioSIS vulnerable to CSV Injection

CVE-2023-29918: RosarioSIS 10.8.4 - CSV Injection

Cybersecurity researchers have uncovered weaknesses in a software implementation of the Border Gateway Protocol (BGP) that could be weaponized to achieve a denial-of-service (DoS) condition on vulnerable BGP peers.
The three vulnerabilities reside in version 8.4 of FRRouting, a popular open source internet routing protocol suite for Linux and Unix platforms. It's currently used by several

Network Security / Vulnerability

Cybersecurity researchers have uncovered weaknesses in a software implementation of the Border Gateway Protocol (BGP) that could be weaponized to achieve a denial-of-service (DoS) condition on vulnerable BGP peers.

The three vulnerabilities reside in version 8.4 of FRRouting, a popular open source internet routing protocol suite for Linux and Unix platforms. It's currently used by several vendors like NVIDIA Cumulus, DENT, and SONiC, posing supply chain risks.

The discovery is the result of an analysis of seven different implementations of BGP carried out by Forescout Vedere Labs: FRRouting, BIRD, OpenBGPd, Mikrotik RouterOS, Juniper JunOS, Cisco IOS, and Arista EOS.

BGP is a gateway protocol that's designed to exchange routing and reachability information between autonomous systems. It's used to find the most efficient routes for delivering internet traffic.

The list of three flaws is as follows -

*   **CVE-2022-40302** (CVSS score: 6.5) - Out-of-bounds read when processing a malformed BGP OPEN message with an Extended Optional Parameters Length option.
*   **CVE-2022-40318** (CVSS score: 6.5) - Out-of-bounds read when processing a malformed BGP OPEN message with an Extended Optional Parameters Length option.
*   **CVE-2022-43681** (CVSS score: 6.5) - Out-of-bounds read when processing a malformed BGP OPEN message that abruptly ends with the option length octet.

The issues "could be exploited by attackers to achieve a DoS condition on vulnerable BGP peers, thus dropping all BGP sessions and routing tables and rendering the peer unresponsive," the company said in a report shared with The Hacker News.

"The DoS condition may be prolonged indefinitely by repeatedly sending malformed packets. The main root cause is the same vulnerable code pattern copied into several functions related to different stages of parsing OPEN messages."

A threat actor could spoof a valid IP address of a trusted BGP peer or exploit other flaws and misconfigurations to compromise a legitimate peer and then issue a specially-crafted unsolicited BGP OPEN message.

This is achieved by taking advantage of the fact that "FRRouting begins to process OPEN messages (e.g., decapsulating optional parameters) before it gets a chance to verify the BGP Identifier and ASN fields of the originating router."

UPCOMING WEBINAR

Learn to Stop Ransomware with Real-Time Protection

Join our webinar and learn how to stop ransomware attacks in their tracks with real-time MFA and service account protection.

Save My Seat!

Forescout has also made available an open source tool called bgp\_boofuzzer that allows organizations to test the security of the BGP suites used internally as well as find new flaws in BGP implementations.

"Modern BGP implementations still have low-hanging fruits that can be abused by attackers," Forescout said. "To mitigate the risk of vulnerable BGP implementations, \[...\] the best recommendation is to patch network infrastructure devices as often as possible."

The findings come weeks after ESET found that secondhand routers previously used in business networking environments harbored sensitive data, including corporate credentials, VPN details, cryptographic keys, and other vital customer information.

"In the wrong hands, the data gleaned from the devices – including customer data, router-to-router authentication keys, application lists, and much more – is enough to launch a cyberattack," the Slovak cybersecurity firm said.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Researchers Uncover New BGP Flaws in Popular Internet Routing Protocol Software

Mattermost Desktop App fails to validate a mattermost server redirection and navigates to an arbitrary website


CVE-2023-2000: Security Updates

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allows an attacker to send the user's call logs to a remote server via XMLHttpRequest or Fetch.

Tag

#ios