Threat Report 8/16/24

Multiple Vulnerabilities in Google Chrome
Could Allow for Arbitrary Code Execution 

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the user's associated privileges, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.  

Affected Systems:

• Chrome prior to 127.0.6533.99/100 for Windows and Mac

• Chrome prior to 126.0.6533.99 for Linux

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices using Google Chrome have the latest version(s) installed

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)

References

• https://chromereleases.googleblog.com/2024/08/stable-channel-update-for-desktop.html
  
  

Critical Patches Issued for Microsoft Products

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged-on user. Depending on the user's associated privileges, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

Affected Systems:

• Windows Secure Kernel Mode
• Windows Kerberos
• Microsoft Windows DNS
• Windows TCP/IP
• Microsoft Office
• Azure Connected Machine Agent
• Windows Kernel
• Windows Power Dependency Coordinator
• Azure Stack
• Azure Health Bot
• Windows IP Routing Management Snapin
• Windows NTFS
• Microsoft Local Security Authority Server (lsasrv)
• Windows Routing and Remote Access Service (RRAS)
• Microsoft Bluetooth Driver
• Microsoft Streaming Service
• Windows Network Address Translation (NAT)
• Windows Clipboard Virtual Channel Extension
• Windows NT OS Kernel
• Windows Resource Manager
• Windows Deployment Services
• Reliable Multicast Transport Driver (RMCAST)
• Windows Ancillary Function Driver for WinSock
• Windows WLAN Auto Config Service
• Windows Layer-2 Bridge Network Driver
• Windows DWM Core Library
• Windows Transport Security Layer (TLS)
• Microsoft WDAC OLE DB provider for SQL
• Windows Security Center
• Azure IoT SDK
• Windows Network Virtualization
• Windows Mobile Broadband
• Windows Update Stack
• Windows Compressed Folder
• Microsoft Dynamics
• .NET and Visual Studio
• Microsoft Office Visio
• Microsoft Office Excel
• Microsoft Office PowerPoint
• Microsoft Office Outlook
• Windows App Installer
• Windows Scripting
• Windows SmartScreen
• Windows Kernel-Mode Drivers
• Microsoft Office Project
• Azure CycleCloud
• Windows Common Log File System Driver
• Microsoft Teams
• Windows Print Spooler Components
• Line Printer Daemon Service (LPD)
• Microsoft Copilot Studio
• Windows Mark of the Web (MOTW)
• Windows Cloud Files Mini Filter Driver
• Microsoft Edge (Chromium-based)
• Windows Initial Machine Configuration

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all Microsoft products have the latest version(s) installed

   

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it

References

•  

  https://msrc.microsoft.com/update-guide/
• https://msrc.microsoft.com/update-guide/releaseNote/2024-Aug

Multiple Vulnerabilities in Adobe Products
Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Affected Systems:

• Adobe Illustrator 2024 28.5 and earlier versions 

   

• Adobe Illustrator 2023 27.9.4 and earlier versions

   

• Adobe Dimension 3.4.11 and earlier versions 

   

• Adobe Photoshop 2023 24.7.3 and earlier versions  

   

• Adobe Photoshop 2024 25.9.1 and earlier versions

   

• Adobe InDesign ID19.4 and earlier version

   

• Adobe InDesign ID18.5.2 and earlier version

   

• Acrobat DC 24.002.20991 and earlier versions (Windows)

   

• Acrobat DC 24.002.20964 and earlier versions (MacOS)

   

• Acrobat Reader DC 24.002.20991 and earlier versions (Windows)

   

• Acrobat Reader DC 24.002.20964 and earlier versions (MacOS)

   

• Acrobat 2024 24.001.30123 and earlier versions

   

• Acrobat 2020 20.005.30636 and earlier versions (Windows)

   

• Acrobat 2020 20.005.30635 and earlier versions (MacOS)

   

• Acrobat Reader 2020 20.005.30636 and earlier versions (Windows)

   

• Acrobat Reader 2020 20.005.30635 and earlier versions (MacOS)

   

• Adobe Bridge 13.0.8 and earlier versions

   

• Adobe Bridge 14.1.1 and earlier versions

   

• Adobe Substance 3D Stager 3.0.2 and earlier versions 

   

•  Adobe Commerce 2.4.7-p1 and earlier

   

• Adobe Commerce 2.4.6-p6 and earlier

   

• Adobe Commerce 2.4.5-p8 and earlier

   

• Adobe Commerce 2.4.4-p9 and earlier

   

• Magento Open Source 2.4.7-p1 and earlier

   

• Magento Open Source 2.4.6-p6 and earlier

   

• Magento Open Source 2.4.5-p8 and earlier

   

• Magento Open Source 2.4.4-p9 and earlier

   

• Adobe InCopy 19.4 and earlier versions

   

• Adobe InCopy 18.5.2 and earlier versions

   

• Adobe Substance 3D Sampler 4.5 and earlier versions

   

• Adobe Substance 3D Designer 13.1.2 and earlier versions 

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices utilizing the above software have the latest version installed

   

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)

References

• https://helpx.adobe.com/security/Home.html
• https://helpx.adobe.com/security/products/illustrator/apsb24-45.html
• https://helpx.adobe.com/security/products/dimension/apsb24-47.html
• https://helpx.adobe.com/security/products/photoshop/apsb24-49.html
• https://helpx.adobe.com/security/products/indesign/apsb24-56.html
• https://helpx.adobe.com/security/products/acrobat/apsb24-57.html
• https://helpx.adobe.com/security/products/bridge/apsb24-59.html
• https://helpx.adobe.com/security/products/substance3d_stager/apsb24-60.html
• https://helpx.adobe.com/security/products/magento/apsb24-61.html
• https://helpx.adobe.com/security/products/incopy/apsb24-64.html
• https://helpx.adobe.com/security/products/substance3d-sampler/apsb24-65.html
• https://helpx.adobe.com/security/products/substance3d_designer/apsb24-67.html
  

Multiple Vulnerabilities in Google Android OS
Could Allow for Remote Code Execution 

Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights.

Affected Systems:

• Android OS patch levels prior to 2024-08-05

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices running Android OS have the latest version(s) installed

   

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it)

References

• https://learn.cisecurity.org/e/799323/s-security-bulletin-2024-08-01/4tsmzk/2239300501/h/4FEP9gGC8NFyhS2ITEzXEz1DiiHefzqdceWwia51Atc
  
  

National Public Data Allegedly Compromised,
Social Security Numbers Threatened 

National Public Data (NPD) is a platform operated by Jerico Pictures corporation that performs employee background checks. NPD has allegedly been the victim of a massive data breach, as claimed by the hacker group “USDoD”.

USDoD listed a collection of reportedly nearly three billion people’s personal records from countries including the United States, Canada, and the United Kingdom on the dark web for $3.5 million. Included in these records are believed to be current and past addresses, full names, and most importantly Social Security numbers. Having been brought to light by a class-action lawsuit on August 1, 2024, the theft of this data is alleged to have occurred in April of this year.

While the validity of the claims from USDoD are still unconfirmed, it is recommended that you monitor items such as your online accounts and credit activity. If you use one password across multiple accounts, it is highly recommended that you change those accounts’ passwords and use a unique password for each.