Vulnerability News - March 31, 2023

Snapshot

March 24, 2023 - March 31, 2023

CISA Known Exploited Vulnerabilities
CVE	Summary	Severity	Vendor	Date Added
CVE-2021-30900	Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.	HIGH	Apple	March 30, 2023
CVE-2022-38181	Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.	HIGH	Arm	March 30, 2023
CVE-2022-22706	Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.	HIGH	Arm	March 30, 2023
CVE-2022-42948	Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.	CRITICAL	Fortra	March 30, 2023
CVE-2022-39197	Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.	MEDIUM	Fortra	March 30, 2023
CVE-2022-3038	Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption.	HIGH	Google	March 30, 2023
CVE-2023-0266	Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.	HIGH	Linux	March 30, 2023
CVE-2014-1776	Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.	HIGH	Microsoft	March 30, 2023
CVE-2013-3163	Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.	HIGH	Microsoft	March 30, 2023
CVE-2017-7494	Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.	CRITICAL	Samba	March 30, 2023
Newswires
10-Year-Old Windows Vulnerability Exploited in 3CX Attack A 10-year-old Windows vulnerability, CVE-2013-3900, continues to be exploited in attacks, making it appear that executables are legitimately signed.				March 31, 2023
Russian Hackers Exploit Zimbra Flaw to Access NATO Emails A Russian hacking group known as TA473, or 'Winter Vivern,' has been exploiting vulnerabilities in unpatched Zimbra endpoints to access the emails of NATO officials, governments, military personnel, and diplomats since February 2023.				March 30, 2023
Microsoft Fixes 'Hazardous' RCE Vulnerability in Azure Cloud Service Microsoft has recently patched a critical remote code execution (RCE) vulnerability in its Azure Service Fabric component.				March 30, 2023
Malware Botnets Actively Exploit Realtek and Cacti Vulnerabilities Multiple malware botnets have been actively targeting Cacti and Realtek vulnerabilities in campaigns detected between January and March 2023, spreading ShellBot and Moobot malware.				March 30, 2023
Critical IBM File Transfer Bug Targeted by Cybercriminals: Patch Urgently Required A critical bug in IBM's Aspera Faspex file transfer stack, tracked as CVE-2022-47986, is catching the attention of cybercriminals, including ransomware gangs, as organizations fail to patch.				March 29, 2023
Google TAG Exposes Exploit Chains Used to Install Commercial Spyware Google's Threat Analysis Group (TAG) has shared information about two distinct, highly targeted campaigns that employed multiple zero-day and n-day exploits against Android, iOS, and Chrome devices.				March 29, 2023
Crown Resorts Investigates Cl0p Ransomware Group's Data Theft Claims Australian casino giant Crown Resorts has confirmed that the Cl0p ransomware group contacted them to claim the theft of data as part of the GoAnywhere attack.				March 29, 2023
ChatGPT Data Breach Confirmed Amid Vulnerable Component Exploitation Warning OpenAI has confirmed a data breach involving its ChatGPT chatbot, which was caused by a bug in the Redis-py open source library.				March 28, 2023
Apple Addresses Actively Exploited WebKit Zero-Day for Older iPhones and iPads Apple has recently released security updates aimed at addressing an actively exploited zero-day bug for older iPhones and iPads.				March 27, 2023
Microsoft Issues Emergency Update for Windows Snipping Tool Flaw Microsoft has released an emergency security update for the Windows 10 and Windows 11 Snipping Tool to fix the Acropalypse privacy vulnerability, which is now tracked as CVE-2023-28303.				March 25, 2023
Vulnerabilities In The News
CVE	Summary	Severity	Vendor	Risk Context
CVE-2023-23397 (6)	Microsoft Outlook Elevation of Privilege Vulnerability	CRITICAL	Microsoft	CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available
CVE-2022-4135 (7)	Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the render...	CRITICAL	Microsoft, Google	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2022-42856 (10)	A type confusion issue was addressed with improved state handling.	HIGH	Apple	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2023-23529 (9)	A type confusion issue was addressed with improved checks.	HIGH	Apple	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2022-38181 (7)	The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled.	HIGH	Arm	CISA Known Exploited
CVE-2022-3723 (6)	Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption...	HIGH	Google	CISA Known Exploited Actively Exploited Remote Code Execution
CVE-2021-30900 (7)	An out-of-bounds write issue was addressed with improved bounds checking.	HIGH	Apple	CISA Known Exploited
CVE-2023-0669 (6)	Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due ...	HIGH	Fortra	CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available
CVE-2023-23383 (5)	Service Fabric Explorer Spoofing Vulnerability	MEDIUM	Microsoft	Actively Exploited Remote Code Execution

CISA Known Exploited Vulnerabilities

CISA added 10 vulnerabilities to the known exploited vulnerabilities list.

Apple — iOS, iPadOS, and macOS

CVE-2021-30900 / Added: March 30, 2023

HIGH CVSS 7.80

Apple GPU drivers, included in iOS, iPadOS, and macOS, contain an out-of-bounds write vulnerability that may allow a malicious application to execute code with kernel privileges.

Headlines

March 31, 2023 - Spyware vendors use exploit chains to take advantage of patch delays in mobile ecosystem
March 30, 2023 - Google - these serious security threats are targeting both Android and iOS devices
March 29, 2023 - Google: Commercial Spyware Used by Governments Laden With Zero-Day Exploits
March 29, 2023 - Google TAG shares details about exploit chains used to install commercial spyware
March 29, 2023 - Spyware Vendors Caught Exploiting Zero-Day Vulnerabilities on Android and iOS Devices
March 29, 2023 - Google finds more Android, iOS zero-days used to install spyware
March 29, 2023 - Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors

Arm — Mali Graphics Processing Unit (GPU)

CVE-2022-38181 / Added: March 30, 2023

HIGH CVSS 8.80

Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that may allow a non-privileged user to gain root privilege and/or disclose information.

Headlines

Arm — Mali Graphics Processing Unit (GPU)

CVE-2022-22706 / Added: March 30, 2023

HIGH CVSS 7.80

Arm Mali GPU Kernel Driver contains an unspecified vulnerability that allows a non-privileged user to achieve write access to read-only memory pages.

Headlines

Fortra — Cobalt Strike

CVE-2022-42948 / Added: March 30, 2023

CRITICAL CVSS 9.80

Fortra Cobalt Strike User Interface contains an unspecified vulnerability rooted in Java Swing that may allow remote code execution.

Headlines

Fortra — Cobalt Strike

CVE-2022-39197 / Added: March 30, 2023

MEDIUM CVSS 6.10

Fortra Cobalt Strike contains a cross-site scripting (XSS) vulnerability in Teamserver that would allow an attacker to set a malformed username in the Beacon configuration, allowing them to execute code remotely.

Headlines

Google — Chrome

CVE-2022-3038 / Added: March 30, 2023

HIGH CVSS 8.80

Google Chrome contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption.

Headlines

Linux — Kernel

CVE-2023-0266 / Added: March 30, 2023

HIGH CVSS 7.80

Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.

Headlines

Microsoft — Internet Explorer

CVE-2014-1776 / Added: March 30, 2023

HIGH CVSS 10.00

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.

Microsoft — Internet Explorer

CVE-2013-3163 / Added: March 30, 2023

HIGH CVSS 9.30

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.

Samba — Samba

CVE-2017-7494 / Added: March 30, 2023

CRITICAL CVSS 9.80

Samba contains a remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.

Headlines

March 7, 2023 - Ransomware's Favorite Target: Critical Infrastructure and Its Industrial Control Systems

In The News

Vulnerabilities receiving the most attention in traditional news media.

CVE-2023-23397

CRITICAL CVSS 9.80

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: March 14, 2023

Microsoft Outlook Elevation of Privilege Vulnerability

Vendor Impacted: Microsoft

Products Impacted: 365 Apps, Outlook, Office

Quotes

The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client
Microsoft has traced evidence of potential exploitation of this vulnerability as early as April 2022
They are a fundamental part of the mechanism used to authenticate a user through different communications protocols
An attacker who successfully exploited this vulnerability could access a user’s Net-NTLMv2 hash which could be used as a basis of an NTLM Relay attack against another service to authenticate as the user
External attackers could send specially crafted emails that will cause a connection from the victim to an untrusted location of attackers' control

Headlines

CVE-2022-4135

CRITICAL CVSS 9.60

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Nov. 25, 2022

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Vendors Impacted: Microsoft, Google

Products Impacted: Edge, Chromium, Edge Chromium

Quotes

The zero-day exploits were used alongside n-day exploits and took advantage of the large time gap between the fix release and when it was fully deployed on end-user devices
Enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
While the use of surveillance technologies may be legal under national or international laws, they are often found to be used by governments to target dissidents, journalists, human rights workers and opposition party politicians
These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house

Headlines

CVE-2022-42856

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Dec. 15, 2022

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16.1.2. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.1..

Vendor Impacted: Apple

Products Impacted: Macos, Ios, Iphone Os, Safari, Ipados, Tvos

Quotes

The zero-day exploits were used alongside n-day exploits and took advantage of the large time gap between the fix release and when it was fully deployed on end-user devices
Enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
While the use of surveillance technologies may be legal under national or international laws, they are often found to be used by governments to target dissidents, journalists, human rights workers and opposition party politicians
We were unable to obtain the final payload for this exploit chain
These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
Processing maliciously crafted web content may lead to arbitrary code execution
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited

Headlines

CVE-2023-23529

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Feb. 27, 2023

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2.1, iOS 16.3.1 and iPadOS 16.3.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited..

Vendor Impacted: Apple

Products Impacted: Macos, Iphone Os, Multiple Products, Safari, Ipados

Quotes

The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client
Apple is aware of a report that this issue may have been actively exploited
To execute arbitrary code with kernel privileges
Processing maliciously crafted web content may lead to arbitrary code execution
May have been actively exploited
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited

Headlines

CVE-2022-38181

HIGH CVSS 8.80

CISA Known Exploited

Published: Oct. 25, 2022

The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.

Vendor Impacted: Arm

Products Impacted: Mali Graphics Processing Unit (Gpu), Bifrost Gpu Kernel Driver, Valhall Gpu Kernel Driver, Midguard Gpu Kernel Driver

Quotes

The zero-day exploits were used alongside n-day exploits and took advantage of the large time gap between the fix release and when it was fully deployed on end-user devices
When ARM released a fix for CVE-2022-38181, several vendors, including Pixel, Samsung, Xiaomi, Oppo and others, did not incorporate the patch, resulting in a situation where attackers were able to freely exploit the bug for several months
Enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
We were unable to obtain the final payload for this exploit chain
These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
When Arm released a fix for CVE-2022-38181, several vendors, including Pixel, Samsung, Xiaomi, Oppo and others, did not incorporate the patch, resulting in a situation where attackers were able to freely exploit the bug for several months

Headlines

CVE-2022-3723

HIGH CVSS 8.80

CISA Known Exploited Actively Exploited Remote Code Execution

Published: Nov. 1, 2022

Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendor Impacted: Google

Product Impacted: Chromium V8 Engine

Quotes

The zero-day exploits were used alongside n-day exploits and took advantage of the large time gap between the fix release and when it was fully deployed on end-user devices
Enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house

Headlines

CVE-2021-30900

HIGH CVSS 7.80

CISA Known Exploited

Published: Aug. 24, 2021

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A malicious application may be able to execute arbitrary code with kernel privileges.

Vendor Impacted: Apple

Products Impacted: Macos, Ios, Ipados, And Macos, Iphone Os, Ipados, Ipad Os

Quotes

The zero-day exploits were used alongside n-day exploits and took advantage of the large time gap between the fix release and when it was fully deployed on end-user devices
Enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house
We were unable to obtain the final payload for this exploit chain
These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house

Headlines

CVE-2023-0669

HIGH CVSS 7.20

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: Feb. 6, 2023

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Vendor Impacted: Fortra

Products Impacted: Goanywhere Mft, Goanywhere Managed File Transfer

Quotes

Request URI ‘/goanywhere/lic/accept/’ from ip address
We were recently contacted by a ransomware group who claim they have illegally obtained a limited number of Crown files. We are investigating the validity of this claim as a matter of priority
The exploit for this CVE was available a day before the patch (7.1.2) was released on February 7 2023. Many vulnerable admin panels of GoAnywhere were found to be indexed on Shodan [a search engine for Internet-connected devices] running on port 8000
On January 30, 2023, we were made aware of suspicious activity within certain instances of our GoAnywhere MFTaaS solution
The access is limited to files that were unable to be processed through the third-party secure file transfer system. The City is actively investigating the details of the identified files

Headlines

CVE-2023-23383

MEDIUM CVSS 5.40

Actively Exploited Remote Code Execution

Published: March 14, 2023

Service Fabric Explorer Spoofing Vulnerability

Vendor Impacted: Microsoft

Product Impacted: Azure Service Fabric

Quotes

The vulnerability arises from a vulnerable ‘Node Name’ parameter, which can be exploited to embed an iframe in the user’s context
It’s worth noting that this attack takes advantage of the Cluster Type Toggle options under the Events Tab in the Service Fabric platform that allows an attacker to overwrite an existing Compose deployment by triggering an upgrade with a specially crafted URL from XSS vulnerability
The Super FabriXss vulnerability enables remote attackers to leverage an XSS vulnerability to achieve remote code execution on a container hosted on a Service Fabric node without the need for authentication
Means that an attacker could potentially gain control of critical systems and cause significant damage

Headlines

Vulnerability and threat intelligence direct to your inbox every week.

Subscribe to Pulse

Accelerate Security Teams

Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.

Request a Demo

Solutions

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Who It’s For

CISO’s

IT & Security Teams

Risk & Compliance

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

March 31, 2023

Subscribe

Accelerate Security Teams

Quick Menu

Solutions

Features

CISO Challenges

IT Challenges

Compliance

Subscribe

By Solution

By Feature

I Want To…

Learn More

VULNERA vs Vulnerability Scanners

Security Assessment Buyers Guide

Resources

Resources

Blog

Threat Intelligence

I Want To…

Learn More

Top 10 Vulnerability Management Questions Answered

About

About

Partners

I Want To…

Learn More

Simplifying Vulnerability Management

VULNERA Pulse

A digest of noteworthy issues being discussed in the information security industry.

March 31, 2023

Snapshot

CISA Known Exploited Vulnerabilities

Newswires

Vulnerabilities In The News

CISA Known Exploited Vulnerabilities

Apple — iOS, iPadOS, and macOS

Arm — Mali Graphics Processing Unit (GPU)

Arm — Mali Graphics Processing Unit (GPU)

Fortra — Cobalt Strike

Fortra — Cobalt Strike

Google — Chrome

Linux — Kernel

Microsoft — Internet Explorer

Microsoft — Internet Explorer

Samba — Samba

In The News

Subscribe

Accelerate Security Teams

Quick Menu

Features

Subscribe