### Impact

basic-auth-connect <1.1.0 uses a timing-unsafe equality comparison that can leak timing information

### Patches

this issue has been fixed in basic-auth-connect 1.1.0

### References


**Exploitability Metrics**

Attack Vector: This metric reflects the context by which vulnerability exploitation is possible. This metric value (and consequently the resulting severity) will be larger the more remote (logically, and physically) an attacker can be in order to exploit the vulnerable system. The assumption is that the number of potential attackers for a vulnerability that could be exploited from across a network is larger than the number of potential attackers that could exploit a vulnerability requiring physical access to a device, and therefore warrants a greater severity.

Attack Complexity: This metric captures measurable actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions in order to obtain a working exploit. These are conditions whose primary purpose is to increase security and/or increase exploit engineering complexity. A vulnerability exploitable without a target-specific variable has a lower complexity than a vulnerability that would require non-trivial customization. This metric is meant to capture security mechanisms utilized by the vulnerable system.

Attack Requirements: This metric captures the prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. These differ from security-enhancing techniques/technologies (ref Attack Complexity) as the primary purpose of these conditions is not to explicitly mitigate attacks, but rather, emerge naturally as a consequence of the deployment and execution of the vulnerable system.

Privileges Required: This metric describes the level of privileges an attacker must possess prior to successfully exploiting the vulnerability. The method by which the attacker obtains privileged credentials prior to the attack (e.g., free trial accounts), is outside the scope of this metric. Generally, self-service provisioned accounts do not constitute a privilege requirement if the attacker can grant themselves privileges as part of the attack.

User interaction: This metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable system. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner.

**Vulnerable System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the VULNERABLE SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the VULNERABLE SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the VULNERABLE SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

**Subsequent System Impact Metrics**

Confidentiality: This metric measures the impact to the confidentiality of the information managed by the SUBSEQUENT SYSTEM due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by, or disclosure to, unauthorized ones.

Integrity: This metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. Integrity of the SUBSEQUENT SYSTEM is impacted when an attacker makes unauthorized modification of system data. Integrity is also impacted when a system user can repudiate critical actions taken in the context of the system (e.g. due to insufficient logging).

Availability: This metric measures the impact to the availability of the SUBSEQUENT SYSTEM resulting from a successfully exploited vulnerability. While the Confidentiality and Integrity impact metrics apply to the loss of confidentiality or integrity of data (e.g., information, files) used by the system, this metric refers to the loss of availability of the impacted system itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of a system.

GHSA-7p89-p6hx-q4fw: basic-auth-connect's callback uses time unsafe string comparison

Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users' personal system profiles. 

### Impact
Disclosure of private system profiles: Platform, OS, OS version, Description.

### Patches
Work in progress

### Workarounds
None

### References
https://mantisbt.org/bugs/view.php?id=34640


GHSA-h5q3-fjp4-2x7r: MantisBT vulnerable to information disclosure with user profiles

Microsoft warns that ransomware group Storm-0501 has shifted from buying initial access to leveraging weak credentials to gain on-premises access before moving laterally to the cloud.

Source: Vitali Gulenok via Alamy Stock Photo

Adversaries have caught on to the complexity that cybersecurity teams face in securing hybrid cloud environments — the latest of which is a particularly odious group tracked as "Storm-0501," a cash-grab operation that regularly targets the most vulnerable organizations, including schools, hospitals, and law enforcement across the US.

Storm-0501 has been around since 2021, according to a new report from Microsoft Threat Intelligence, operating as affiliates of a variety of ransomware-as-a-service (RaaS) strains including BlackCat/ALPHV, LockBit, and Embargo.

Notably, Microsoft has observed a shift in approach by the ransomware group. Once reliant on buying initial access from brokers, Storm-0501 has more recently found success exploiting hybrid cloud environments with weak passwords and overprivileged accounts. They first crack into the on-premises environment at a target, then pivot to burrow into the cloud, as seen in one campaign that successfully targeted Entra ID credentials.

**Microsoft Entra Connect Credential Crack**

The Microsoft team detailed a recent attack from Storm-0501 threat actors that used compromised credentials to access Microsoft Entra ID (formerly Azure AD). This on-premises Microsoft application is responsible for synching passwords and other sensitive data between objects in Active Directory and Entra ID, which essentially allows a user to sign in to both on-premises and cloud environments using the same credentials.

Once Storm-0501 was able to move laterally into the cloud, it was able to tamper with and exfiltrate data, set up persistent backdoor access, and deploy ransomware, the report warned.

"We can assess with high confidence that in the recent Storm-0501 campaign, the threat actor specifically located Microsoft Entra Connect Sync servers and managed to extract the plain text credentials of the Microsoft Entra Connect cloud and on-premises sync accounts," Microsoft reported. "Following the compromise of the cloud Directory Synchronization Account, the threat actor can authenticate using the clear-text credentials and get an access token to Microsoft Graph."

From there, an attacker can freely change the Microsoft Entra ID passwords of any hybrid, synced account.

But that's not the only way these slippery cybercriminals have found to vault from a compromised Entra ID account into the cloud. The second strategy is more complicated, as Microsoft detailed, and relied on breaching a domain admin account with a correlating Entra ID that is designated with global admin permissions. Additionally, the account needs to have multifactor authentication (MFA) disabled for the attackers to be successful.

"It is important to mention that the sync service is unavailable for administrative accounts in Microsoft Entra, hence the passwords and other data are not synced from the on-premises account to the Microsoft Entra account in this case," Microsoft said. "However, if the passwords for both accounts are the same, or obtainable by on-premises credential theft techniques (i.e. Web browsers' passwords store), then the pivot is possible."

Once it was in, Storm-0501 got busy setting up persistent backdoor access for later, working to achieve network control, and ensuring lateral movement to the cloud, Microsoft reported. Once that was done, they exfiltrated the files they wanted and deployed Embargo ransomware across the entire organization.

"In the cases observed by Microsoft, the threat actor leveraged compromised Domain Admin accounts to distribute the Embargo ransomware via a scheduled task named 'SysUpdate' that was registered via GPO on the devices in the network," according to the Microsoft report.

The two separate versions of attacks against Microsoft's Entra ID application demonstrate that cybercriminals of opportunity have focused in on hybrid cloud environments, and their big, fat attack surfaces, as easy wins.

**Securing the Hybrid Cloud Against Storm-0501 Attacks**

"As hybrid cloud environments become more prevalent, the challenge of securing resources across multiple platforms grows ever more critical for organizations," Microsoft's Threat Intel team warned.

Enterprise cybersecurity teams can achieve this by continuing to move toward a zero-trust framework, according to a statement from Patrick Tiquet, vice president, security and architecture, at Keeper Security.

"This model restricts access based on continuous verification, ensuring that users only have access to the resources essential for their specific roles, minimizing exposure to malicious actors," Tiquet explained via email. "Weak credentials remain one of the most vulnerable entry points in hybrid cloud environments, and groups like Storm-0501 are likely to exploit them."

Centralizing endpoint device management (EDM) is also "essential," he said. "Ensuring consistent security patching across all environments — whether cloud-based or on-premises — prevents attackers from exploiting known vulnerabilities."

Advanced monitoring will help teams spot potential threats across hybrid cloud environments before they can become a breach, he added.

Stephen Kowski, field CTO at SlashNext Security echoed many of the same recommendations in an emailed statement.

"This report highlights the critical need for robust security measures across hybrid cloud environments," Kowski said. "Security teams should prioritize strengthening identity and access management, implementing least privilege principles, and ensuring timely patching of Internet-facing systems."

In addition, he suggested shoring up security to protect against initial access attempts.

"Deploying advanced email and messaging security solutions can help prevent initial access attempts through phishing or social engineering tactics that often serve as entry points for these sophisticated attacks," he added.

Sloppy Entra ID Credentials Attract Hybrid Cloud Ransomware

Debian Linux Security Advisory 5778-1 - Simone Margaritelli reported several vulnerabilities in cups-filters. Missing validation of IPP attributes returned from an IPP server and multiple bugs in the cups-browsed component can result in the execution of arbitrary commands without authentication when a print job is started.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5778-1                   security@debian.org  
https://www.debian.org/security/                     Salvatore Bonaccorso  
September 29, 2024                    https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : cups-filters  
CVE ID         : CVE-2024-47076 CVE-2024-47176  
Debian Bug     : 1082820 1082827

Simone Margaritelli reported several vulnerabilities in cups-filters.  
Missing validation of IPP attributes returned from an IPP server and  
multiple bugs in the cups-browsed component can result in the execution  
of arbitrary commands without authentication when a print job is  
started.

For the stable distribution (bookworm), these problems have been fixed in  
version 1.28.17-3+deb12u1.

We recommend that you upgrade your cups-filters packages.

For the detailed security status of cups-filters please refer to its  
security tracker page at:  
https://security-tracker.debian.org/tracker/cups-filters

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQKTBAEBCgB9FiEERkRAmAjBceBVMd3uBUy48xNDz0QFAmb5b6BfFIAAAAAALgAo  
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDQ2  
NDQ0MDk4MDhDMTcxRTA1NTMxRERFRTA1NENCOEYzMTM0M0NGNDQACgkQBUy48xND  
z0RqGA//VfGe41guaMVg8lIgwu9s3atSUeoUDZRf83XWQ0S6gvpTCG/Bko1KSgj0  
xmzHlmjwFA2Sly5PhiWcqDp59txdXZymdojTXFebuE5MFqxcSLoIpn/vxZT6f3ky  
BdfK4oTXfJ5Au+KgRF+jC9zGiKgkMJfaCaf2PPFwan/4nXLYw/GIkvnYAecjGgEQ  
KjuzUgkItBVaGVeaInMISwfSISQFrMK80P7MJyX8ET2b71ijjpReAbfsuOQRaizj  
5dnBXxCAE8l8A5VsZFUT1EK4m3Z7BgKKImnLqDdk61Mz+T7eC4R+Kv+rb5lLBMYK  
pPuBmYlH80U7bK4/TaivuWrX6FdHvtKGFUmQd+YO6rWofwrCTn/8+SlO8ZWOrjKx  
r7UDU7+XTnCu4DI87+7PBcqHEyQTG3CrK/RKblsfw0PP0DFtwJMiipuSjzBmNRZx  
nZppuug7Ks5dljAYGWFrBx2I29Qtj6MD4HeI4JKWoB3r3Xi1gX5vvsav4/r++s9Z  
GvINaqBBIytLjATxLYElCxA74MEmVFNPxUEeEq8xFyPGdnYquJ6xZ6wsy6x+O6Z2  
T4ikIV5+FUA4v/c9JFdMj04dJXXaIfTcxBvYA4CoykdHmMGAw1/rCuucL4zoPMUl  
G03rz0k3/QziqZ6EM/Firbd++RrCo86wBiA10Anmhy7+0kS3TCE=  
=fH4o  
-----END PGP SIGNATURE-----

Debian Security Advisory 5778-1

VegaBird Vooki version 5.2.9 suffers from a dll hijacking vulnerability.

    ====================================CVE ID: CVE-2024-45874Author: Iulian FloreaVendor: VegaBirdProduct:  Vooki - Dynamic Web Application & REST API Vulnerability Scanner (DAST Tool)Vulnerability Type: DLL Hijacking========================================================================Summary==================================== A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe.====================================Exploitation====================================By placing an arbitrary DLL (Example: dcomp.dll) within the application folder (C:\Program Files\Vooki) and opening the application (Vooki.exe) it can be noted that the DLL is being loaded. This can lead to persistence or in some cases to privilege escalation.

VegaBird Vooki 5.2.9 DLL Hijacking

VegaBird Yaazhini version 2.0.2 suffers from a dll hijacking vulnerability.

    ====================================CVE ID: CVE-2024-45873Author: Iulian FloreaVendor: VegaBirdProduct:  Vooki - Free Android APK & API Vulnerability Scanner(Yaazhini)Vulnerability Type: DLL Hijacking========================================================================Summary==================================== A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a crafted DLL file in the same directory as Yaazhini.exe.====================================Exploitation====================================By placing an arbitrary DLL (Example: dcomp.dll) within the application folder (C:\Users\<USER>\AppData\Local\Programs\Yaazhini) and opening the application (Yaazhini.exe) it can be noted that the DLL is being loaded. This can lead to persistence or in some cases to privilege escalation.

VegaBird Yaazhini 2.0.2 DLL Hijacking

Gentoo Linux Security Advisory 202409-32 - Multiple vulnerabilities have been discovered in nginx, the worst of which could result in denial of service. Versions greater than or equal to 1.26.2-r2 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202409-32  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low  
    Title: nginx: Multiple Vulnerabilities  
     Date: September 28, 2024  
     Bugs: #924619, #937938  
       ID: 202409-32

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been discovered in nginx, the worst of  
which could result in denial of service.

Background  
==========

nginx is a robust, small, and high performance HTTP and reverse proxy  
server.

Affected packages  
=================

Package            Vulnerable    Unaffected  
-----------------  ------------  ------------  
www-servers/nginx  < 1.26.2-r2   >= 1.26.2-r2

Description  
===========

Multiple vulnerabilities have been discovered in nginx. Please review  
the CVE identifiers referenced below for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All nginx users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=www-servers/nginx-1.26.2-r2"

References  
==========

[ 1 ] CVE-2024-7347  
      https://nvd.nist.gov/vuln/detail/CVE-2024-7347  
[ 2 ] CVE-2024-24989  
      https://nvd.nist.gov/vuln/detail/CVE-2024-24989  
[ 3 ] CVE-2024-24990  
      https://nvd.nist.gov/vuln/detail/CVE-2024-24990

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202409-32

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202409-32

Gentoo Linux Security Advisory 202409-31 - Multiple vulnerabilities have been found in Apache HTTPD, the worst of which could result in denial of service. Versions greater than or equal to 2.4.62 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202409-31  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low  
    Title: Apache HTTPD: Multiple Vulnerabilities  
     Date: September 28, 2024  
     Bugs: #928540, #935296, #935427, #936257  
       ID: 202409-31

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been found in Apache HTTPD, the worst of  
which could result in denial of service.

Background  
==========

The Apache HTTP server is one of the most popular web servers on the  
Internet.

Affected packages  
=================

Package             Vulnerable    Unaffected  
------------------  ------------  ------------  
www-servers/apache  < 2.4.62      >= 2.4.62

Description  
===========

Multiple vulnerabilities have been discovered in Apache HTTPD. Please  
review the CVE identifiers referenced below for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All Apache HTTPD users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=www-servers/apache-2.4.62"

References  
==========

[ 1 ] CVE-2023-38709  
      https://nvd.nist.gov/vuln/detail/CVE-2023-38709  
[ 2 ] CVE-2024-24795  
      https://nvd.nist.gov/vuln/detail/CVE-2024-24795  
[ 3 ] CVE-2024-27316  
      https://nvd.nist.gov/vuln/detail/CVE-2024-27316  
[ 4 ] CVE-2024-36387  
      https://nvd.nist.gov/vuln/detail/CVE-2024-36387  
[ 5 ] CVE-2024-38472  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38472  
[ 6 ] CVE-2024-38473  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38473  
[ 7 ] CVE-2024-38474  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38474  
[ 8 ] CVE-2024-38475  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38475  
[ 9 ] CVE-2024-38476  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38476  
[ 10 ] CVE-2024-38477  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38477  
[ 11 ] CVE-2024-39573  
      https://nvd.nist.gov/vuln/detail/CVE-2024-39573  
[ 12 ] CVE-2024-39884  
      https://nvd.nist.gov/vuln/detail/CVE-2024-39884  
[ 13 ] CVE-2024-40725  
      https://nvd.nist.gov/vuln/detail/CVE-2024-40725  
[ 14 ] CVE-2024-40898  
      https://nvd.nist.gov/vuln/detail/CVE-2024-40898

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202409-31

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory 202409-31

BlackBerry CylanceOPTICS versions prior to 3.3 MR2 and 3.2 MR5 suffer from an uninstall password bypass vulnerability.

SEC Consult Vulnerability Lab Security Advisory < 20240925-0 >  
=======================================================================  
              title: Uninstall Password Bypass  
            product: BlackBerry CylanceOPTICS Windows Installer Package  
 vulnerable version: CylanceOPTICS <3.3 MR2  
                     CylanceOPTICS <3.2 MR5  
      fixed version: CylanceOPTICS 3.3 MR2  
                     CylanceOPTICS 3.2 MR5  
         CVE number: CVE-2024-35214  
             impact: high  
           homepage: https://www.blackberry.com/us/en/support/cylance  
              found: 2023-12-12  
                 by: Initially by Rene Grubmair (Greiner)  
                     P. Espernberger (Office Leonding)  
                     M. Engleitner (Office Leonding)  
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult, an Eviden business  
                     Europe | Asia

                     https://www.sec-consult.com

=======================================================================

Vendor description:  
-------------------  
"CylanceOPTICS is an endpoint detection and response solution that collects  
and analyzes forensic data from devices to identify and resolve threats  
before they impact your organization’s users and data."

Source: https://docs.blackberry.com/en/unified-endpoint-security/blackberry-ues/overview/What-is-BlackBerry-Optics

Business recommendation:  
------------------------  
The vendor provides a patched version which should be installed immediately.

SEC Consult highly recommends to perform a thorough security review of the  
product conducted by security professionals to identify and resolve potential  
further security issues.

Vulnerability overview/description:  
-----------------------------------  
1) Uninstall Password Bypass (CVE-2024-35214)  
Due to the quiet (un-)installation feature offered by the CylanceOPTICS  
application, the uninstaller can be called directly without requiring  
a previously set uninstall password.

In order to exploit this vulnerability, an attacker must have local admin  
rights.

Proof of concept:  
-----------------  
1) Uninstall Password Bypass (CVE-2024-35214)  
The path to the MSI uninstaller can be found by searching the  
Windows Registry for "CylanceOPTICS" which results in the following  
node containing uninstall information for the 64bit application:

HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6e96194b-ca7b-40a4-badd-7eac94ea62c7}

To uninstall CylanceOPTICS without being prompted for a password,  
the QuietUninstallString command is executed as privileged user on  
the system.

"C:\ProgramData\Package Cache\{6e96194b-ca7b-40a4-badd-7eac94ea62c7}\CylanceOPTICSSetup.exe" /uninstall /quiet

Afterwards, the CylanceOPTICS application is successfully removed.

Vulnerable / tested versions:  
-----------------------------  
The following version has been tested by SEC Consult which was the most  
recent version available at the time of the test:  
* 3.2.2199.0

According to the vendor, all previous versions are affected:  
* CylanceOPTICS <3.3 MR2  
* CylanceOPTICS <3.2 MR5

Vendor contact timeline:  
------------------------  
2024-02-02: Contacting vendor through secure@blackberry.com, case  
            BIRT2024-00128 was created  
2024-02-02: Auto-response, case is being tracked as # BIRT2024-00128  
2024-02-07: Vendor requests settings of the CylanceConsole device.  
            Vendor is currently attempting to reproduce the vulnerability.  
2024-02-08: The requested settings were provided.  
2024-02-09: Vendor confirms the Uninstall Password Bypass vulnerability.  
            Additional information (log files) are requested.  
            Clarification of the impact of the vulnerability is requested.  
2024-02-15: Explanation has been sent. Log files could not be provided  
            as the device has already been reset.  
2024-02-15: The vulnerability was escalated to the development team.  
2024-02-23: Short update was provided outlining the current plan to  
            fix the vulnerability until summer 2024.  
            Vendor commits to bi-weekly updates on their progress.  
2024-04-19: Expected release date (June 3rd) was communicated and  
            the CVE number was provided.  
2024-05-21: Coordination of the joint release date (2024-06-11) and  
            providing the updated security advisory and new CVE number.  
2024-06-07: Vendor released CylanceOPTICS 3.3 MR1 and CylanceOPTICS 3.2 MR4  
            on 4th June. But requests advisory disclosure to be delayed to  
            10th September because of identified weakness in current solution.  
2024-08-20: Vendor releases new version 3.3 MR2 and 3.2 MR5.  
2024-09-25: Coordinated release of security advisory.

SEC Consult was informed about the progress bi-weekly.  
Only the most relevant information is included in the timeline.

Solution:  
---------  
The vendor provides the following patched versions to their customers:  
* CylanceOPTICS 3.3 MR2  
* CylanceOPTICS 3.2 MR5

In addition to the updated versions, the vendor has released an  
optional script which customers can run to remove the old version and replace  
it with the update. New customers, or customers who uninstall /  
reinstall will not need to run the script, nor will existing customers  
who have not configured an Uninstall password.

The vendor provides the following security notes with further information:  
https://support.blackberry.com/pkb/s/article/140080

Workaround:  
-----------  
As a workaround, it is possible to delete the affected CylanceOPTICSSetup.exe  
binary.

Advisory URL:  
-------------  
https://sec-consult.com/vulnerability-lab/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SEC Consult Vulnerability Lab  
An integrated part of SEC Consult, an Eviden business  
Europe | Asia

About SEC Consult Vulnerability Lab  
The SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an  
Eviden business. It ensures the continued knowledge gain of SEC Consult in the  
field of network and application security to stay ahead of the attacker. The  
SEC Consult Vulnerability Lab supports high-quality penetration testing and  
the evaluation of new offensive and defensive technologies for our customers.  
Hence our customers obtain the most current information about vulnerabilities  
and valid recommendation about the risk profile of new technologies.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
Interested to work with the experts of SEC Consult?  
Send us your application https://sec-consult.com/career/

Interested in improving your cyber security with the experts of SEC Consult?  
Contact our local offices https://sec-consult.com/contact/  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Mail: security-research at sec-consult dot com  
Web: https://www.sec-consult.com  
Blog: https://blog.sec-consult.com  
Twitter: https://twitter.com/sec_consult

EOF M. Engleitner, P. Espernberger / @2024

BlackBerry CylanceOPTICS Uninstall Password Bypass

Gentoo Linux Security Advisory 202409-30 - Multiple vulnerabilities have been found in yt-dlp, the worst of which could result in arbitrary code execution. Versions greater than or equal to 2024.07.01 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
Gentoo Linux Security Advisory                           GLSA 202409-30  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  
                                           https://security.gentoo.org/  
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Normal  
    Title: yt-dlp: Multiple Vulnerabilities  
     Date: September 28, 2024  
     Bugs: #909780, #917355, #935316  
       ID: 202409-30

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis  
========

Multiple vulnerabilities have been found in yt-dlp, the worst of which  
could result in arbitrary code execution.

Background  
==========

yt-dlp is a youtube-dl fork with additional features and fixes.

Affected packages  
=================

Package          Vulnerable    Unaffected  
---------------  ------------  -------------  
net-misc/yt-dlp  < 2024.07.01  >= 2024.07.01

Description  
===========

Multiple vulnerabilities have been found in yt-dlp. Please review the  
referenced CVE identifiers for details.

Impact  
======

Please review the referenced CVE identifiers for details.

Workaround  
==========

There is no known workaround at this time.

Resolution  
==========

All yt-dlp users should upgrade to the latest version:

  # emerge --sync  
  # emerge --ask --oneshot --verbose ">=net-misc/yt-dlp-2024.07.01"

References  
==========

[ 1 ] CVE-2023-35934  
      https://nvd.nist.gov/vuln/detail/CVE-2023-35934  
[ 2 ] CVE-2023-46121  
      https://nvd.nist.gov/vuln/detail/CVE-2023-46121  
[ 3 ] CVE-2024-38519  
      https://nvd.nist.gov/vuln/detail/CVE-2024-38519

Availability  
============

This GLSA and any updates to it are available for viewing at  
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202409-30

Concerns?  
=========

Security is a primary focus of Gentoo Linux and ensuring the  
confidentiality and security of our users' machines is of utmost  
importance to us. Any security concerns should be addressed to  
security@gentoo.org or alternatively, you may file a bug at  
https://bugs.gentoo.org.

License  
=======

Copyright 2024 Gentoo Foundation, Inc; referenced text  
belongs to its owner(s).

The contents of this document are licensed under the  
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Tag

#vulnerability