Threat Report 2/15/24

A Vulnerability in Google Chrome
Could Allow for Arbitrary Code Execution   

Multiple vulnerabilities have been discovered in Google Chrome, which could allow for arbitrary code execution. Google Chrome is a web browser used to access the internet. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

Affected Systems:

• Chrome prior to 121.0.6167.160/161 for Windows 
• Chrome prior to 121.0.6167.160 for Mac and Linux 
  
  

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices with Google Chrome have the latest version installed.  
• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it).

References

• https://chromereleases.googleblog.com/

Critical Patches Issued for Microsoft Products       

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

Affected Systems:

• Popular Microsoft products including, but not limited to, Windows, Office, and Edge  
  
  
  

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all Microsoft products have the latest version(s) installed 
• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 
  
  

References

• https://msrc.microsoft.com/update-guide/  
  

• https://msrc.microsoft.com/update-guide/releaseNote/2024-Feb  

   

Multiple Vulnerabilities in Adobe Products
Could Allow for Arbitrary Code Execution     

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution for the following: 

• Adobe Commerce is an offering that provides companies with a flexible and scalable end-to-end plate form to manage the commerce experiences of their customers. 
• Adobe Acrobat is used to view, create, print, and manage PDF files. 
• Adobe Audition is a professional audio editing application that includes a non-destructive mixing and editing environment. 
• Adobe FrameMaker Publishing Server is an enterprise software that allows you to automate your multichannel publishing process. 
• Adobe Substance 3D Stager is a state-of-the-art staging tool to create 3D scenes with real-time 3D visualization and high-quality renders. 

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights 

Affected Systems:

• Adobe Commerce version 2.4.6-p3 and earlier 
• Adobe Commerce version 2.4.5-p5 and earlier
• Adobe Commerce version 2.4.4-p6 and earlier
• Adobe Commerce version 2.4.3-ext-5 and earlier
• Adobe Commerce version 2.4.2-ext-5 and earlier
• Adobe Commerce version 2.4.1-ext-5 and earlier
• Adobe Commerce version 2.4.0-ext-5 and earlier
• Adobe Commerce version 2.3.7-p4-ext-5 and earlier
• Adobe Substance 3D Painter version 9.1.1 and earlier
• Acrobat DC version 23.008.20470 and earlier
• Acrobat Reader DC version 23.008.20470 and earlier
• Acrobat 2020 version 20.005.30539 and earlier
• Acrobat Reader 2020 version 20.005.30539 and earlier
• Adobe FrameMaker Publishing Server Version 2022 Update 1 and earlier
• Adobe Audition version 24.0.3 and earlier
• Adobe Audition version 23.6.2 and earlier
• Adobe Substance 3D Designer version 13.1.0 and earlier 

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices running Adobe products have the latest version(s) installed 

• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

References

• https://helpx.adobe.com/security.html 
  
• https://helpx.adobe.com/security/products/magento/apsb24-03.html 
  
• https://helpx.adobe.com/security/products/substance3d_painter/apsb24-04.html 
  
• https://helpx.adobe.com/security/products/acrobat/apsb24-07.html 
  
• https://helpx.adobe.com/security/products/framemaker-publishing-server/apsb24-10.html 
  
• https://helpx.adobe.com/security/products/audition/apsb24-11.html 
  
• https://helpx.adobe.com/security/products/substance3d_designer/apsb24-13.html 

   

Multiple Vulnerabilities in Google Android OS
Could Allow for Remote Code Execution 

Multiple vulnerabilities have been discovered in Google Android OS, the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution. Depending on the privileges associated with the exploited component, an attacker could then install programs; view, change, or delete data; or create new accounts with full rights. .  

Affected Systems:

• Android OS patch levels prior to 2024-02-05 

Risk

• Large and medium business entities: High
• Small business entities: Medium

Remediation Recommendations

• Ensure all devices running Google Android products have the latest version(s) installed.
• Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 
  
  

References

• https://source.android.com/docs/security/bulletin/2024-02-01

Malicious App Impersonates LastPass  

A malicious app impersonating the LastPass password manager made it into Apple's App Store, BleepingComputer reports. Apple has since removed the app. TechCrunch notes that although the app was available for several weeks, it doesn't seem to have had many downloads. Christofer Hoff, chief secure technology officer for LastPass, told the Register, "[We're] working with Apple to understand more broadly how an application like this passed their normally rigorous security and brand protection mechanisms. The naming convention, the iconography, and the description of the fraudulent app are all heavily borrowed from LastPass, and this appears to be a deliberate attempt to target LastPass users."