Merry fucking Christmas from Palo Alto Networks (Zero-Day): CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet
CVE-2024-3393 (CVSSv4: 8.7 high) A Denial of Service vulnerability in the DNS Security feature of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to send a malicious packet through the data plane of the firewall that reboots the firewall. Repeated attempts to trigger this condition will cause the firewall to enter maintenance mode.

Palo Alto Networks is aware of customers experiencing this denial of service (DoS) when their firewall blocks malicious DNS packets that trigger this issue.

Merry Christmas from the goat: Vendor Verbiage is a list of common example messages used by software vendors to note that a vulnerability is publicly disclosed or exploited in the wild. This should come in handy when quickly scanning through security advisories on Patch Tuesday. Enjoy!

Prepare your NX-OS and bite the pillow because Cisco has some zero-days!

• EXPLOITED ZERO-DAY: Cisco Adaptive Security Appliance and Firepower Threat Defense Software Remote Access VPN Brute Force Denial of Service Vulnerability CVE-2024-20481 (5.8 medium)
  • The Cisco Product Security Incident Response Team (PSIRT) is aware of malicious use of the vulnerability that is described in this advisory.
• PROOF OF CONCEPT ZERO-DAYS: Cisco Secure Firewall Management Center Software Cross-Site Scripting and Information Disclosure Vulnerabilities The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in this advisory:
  • CVE-2024-20377 (5.4 medium) Cisco FMC Software Stored XSS Vulnerability
  • CVE-2024-20387 (5.4 medium) Cisco FMC Software Web-Based Management Interface Stored XSS Vulnerability
  • CVE-2024-20388 (5.3 medium) Cisco FMC Software API Response Information Disclosure Vulnerability

In case you wanted even more Cisco, they dropped a total of 36 security advisories today, 23 October 2024.

Fortinet exploited zero-day: FG-IR-24-423 Missing authentication in fgfmsd
CVE-2024-47575 (9.8 critical, disclosed 23 October by Fortinet, noted earlier on 13 October by @GossiTheDog on Mastodon) Fortinet FortiManager Missing Authentication Vulnerability.

• Reports have shown this vulnerability to be exploited in the wild.
• The identified actions of this attack in the wild have been to automate via a script the exfiltration of various files from the FortiManager which contained the IPs, credentials and configurations of the managed devices.

CISA added CVE-2024-47575 to the KEV Catalog about 3 hours afterward.

Just in case you didn't read closely, there are indicators of compromise (IoC) in the advisory. At least one of the IP addresses was reportedly used as a Cobalt Strike server 2 years ago.

cc: @cR0w @nopatience I require at least 25 favorites to unlock my next toot!

#fortinet #fortimanager #cve #zeroday #CVE_2024_47575 #vulnerability #eitw #activeexploitation #kev #cisakev #KnownExploitedVulnerabilitiesCatalog

Ivanti Security Advisory: Ivanti CSA (Cloud Services Application) (CVE-2024-9379, CVE-2024-9380, CVE-2024-9381)
Very sneaky of Ivanti to quietly update the security advisory without a changelog: They removed CVE-2024-9381 (CVSSv3: 7.2 high) Path traversal in Ivanti CSA before version 5.0.2 from the exploitation announcement:

We have observed limited exploitation of CSA 4.6 when CVE-2024-9379 or CVE-2024-9380 are chained with CVE-2024-8963, present in CSA 4.6 patch 518 and below, it could lead to unauthenticated remote code execution. We have not observed these vulnerabilities being exploited in CSA 5.0.

See parent toot above for the original wording. cc: @cR0w @reverseics

Happy EXPLOITED ZERO-DAY #PatchTuesday from Ivanti: October Security Update

We are aware of a limited number of customers running CSA 4.6 patch 518 and prior who have been exploited when CVE-2024-9379, CVE-2024-9380 or CVE-2024-9381 are chained with CVE-2024-8963.

• CVE-2024-9379 (6.5 medium) SQL injection
• CVE-2024-9380 (7.2 high) OS command injection
• CVE-2024-9381 (7.2 high) path traversal cc: @cR0w @reverseics