Threat Report 10/18/24

Critical Patches Issued for Microsoft Products  

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those with administrative user rights. 

Affected Systems:

• Many Microsoft Products including, but not limited to, Windows, Office products, and .NET 

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all Microsoft products have the latest version(s) installed 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)

References

• https://portal.msrc.microsoft.com/en-us/security-guidance 
  
• https://msrc.microsoft.com/update-guide/releaseNote/2024-Oct 

     Multiple Vulnerabilities in in Google Chrome
Could Allow for Arbitrary Code Execution 

Multiple vulnerabilities have been discovered in Mozilla Products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those with administrative user rights. 

Affected Systems:

• Chrome prior to 130.0.6723.58/59 for Windows and Mac 
• Chrome prior to 130.0.6723.58 for Linux 

Risk

• Large and medium business entities: High
• Small business entities: Medium
  

Remediation Recommendations

• Ensure all devices using Google Chrome have the latest version(s) installed 
• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it
  
  

References

• https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html
  
  

Multiple Vulnerabilities in Adobe Products
Could Allow for Arbitrary Code Execution  

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. 

Affected Systems:

• Adobe Substance 3D Painter 10.0.1 and earlier versions 

   

• Adobe Commerce 2.4.7-p2 and earlier versions 

   

• Adobe Commerce 2.4.6-p7 and earlier versions 

   

• Adobe Commerce 2.4.5-p9 and earlier versions 

   

• Adobe Commerce 2.4.4-p10 and earlier versions 

   

• Adobe Commerce B2B 1.4.2-p2 and earlier versions 

   

• Adobe Commerce B2B 1.3.5-p7 and earlier versions 

   

• Adobe Commerce B2B 1.3.4-p9 and earlier versions 

   

• Adobe Commerce B2B 1.3.3-p10 and earlier versions 

   

• Magento Open Source 2.4.7-p2 and earlier versions 

   

• Magento Open Source 2.4.6-p7 and earlier versions 

   

• Magento Open Source 2.4.5-p9 and earlier versions 

   

• Magento Open Source 2.4.4-p10 and earlier versions 

   

• Adobe Dimension 4.0.3 and earlier versions 

   

• Adobe Animate 2023 23.0.7 and earlier versions 

   

• Adobe Animate 2024 24.0.4 and earlier versions 

   

• Lightroom 7.4.1 and earlier versions     

   

• Lightroom Classic 13.5 and earlier versions 

   

• Lightroom Classic (LTS) 12.5.1 and earlier versions 

   

• Adobe InCopy  19.4 and earlier versions 

   

• Adobe InCopy  18.5.3 and earlier versions      

   

• Adobe InDesign ID19.4 and earlier version 

   

• Adobe InDesign ID18.5.3 and earlier version                                       

   

• Adobe Substance 3D Stager 3.0.3 and earlier versions  

   

• Adobe FrameMaker 2020 Release Update 6 and earlier versions 

   

• Adobe FrameMaker 2022 Release Update 4 and earlier versions

   

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all versions of all Adobe products are updated to their latest versions 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)

References

• https://helpx.adobe.com/security/Home.html 
  
• https://helpx.adobe.com/security/products/substance3d_painter/apsb24-52.html 
  
• https://helpx.adobe.com/security/products/magento/apsb24-73.html 
  
• https://helpx.adobe.com/security/products/dimension/apsb24-74.html 
  
• https://helpx.adobe.com/security/products/animate/apsb24-76.html 
  
• https://helpx.adobe.com/security/products/lightroom/apsb24-78.html 
  
• https://helpx.adobe.com/security/products/incopy/apsb24-79.html 
  
• https://helpx.adobe.com/security/products/indesign/apsb24-80.html 
  
• https://helpx.adobe.com/security/products/substance3d_stager/apsb24-81.html 
  
• https://helpx.adobe.com/security/products/framemaker/apsb24-82.html 
  
  
  

Multiple Vulnerabilities in Google Android OS
Could Allow for Remote Code Execution  

Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.  

Affected Systems:

• Android OS patch levels prior to 2024-10-05 

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices running Android OS have the latest version(s) installed 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)

References

• https://source.android.com/docs/security/bulletin/2024-10-01

CISA requires Federal agencies
to patch Fortinet flaw by October 30th 

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a critical Fortinet flaw (CVE-2024-23113) to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal agencies to patch the flaw by October 30th. Fortinet fixed the flaw in February, but many devices remain unpatched. CyberScoop notes that, as of Sunday, more than 86,000 IP addresses were vulnerable. 

The flaw is a format string vulnerability affecting Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb, allowing "a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests." The vulnerability was assigned a CVSS score of 9.8.