IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Weekly threat roundup: Microsoft Exchange, Chrome, Spectre

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Four exploited zero-days in Microsoft Exchange Server

State-backed hackers operating out of China are actively exploiting four critical zero-day vulnerabilities in Microsoft’s Exchange mail servers.

The vulnerabilities tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 are embedded in Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019, with Exchange Online unaffected.

Microsoft claims that the attackers are exploiting these flaws as part of a chain attack, with the initial attack demanding the ability to make an untrusted connection to Exchange server port 443. Businesses can protect against the attack by setting up a VPN to separate the Exchange server from external access, or by restricting untrusted connections.

This mitigation will only work against the initial phase of the attack, with hackers able to trigger other attacks along the chain if they already have access. As such, the firm has advised businesses to update their Exchange Server installations immediately.

Google fixes actively exploited Chrome flaw

Google has patched a series of flaws in its Chrome browser including the severe CVE-2021-21166, described as an “object lifecycle issue in audio” which is under exploitation by cyber criminals.

This is the fifth vulnerability discovered this week being actively exploited, and was patched alongside 32 other Chrome flaws in version 89.0.4389.72 of the browser. These included eight high-risk vulnerabilities.

It was first discovered by Alison Huffman, who works with Microsoft’s browser vulnerability research team. She also reported two additional high-risk flaws tagged CVE-2021-21165 and CVE-2021-21163. The former was also described as an “object lifecycle issue in audio” while the latter involved “insufficient data validation in Reader Mode”.

Malicious code found in JavaScript repositories

Hackers have placed malicious code in JavaScript repositories that could allow them to steal password files in Linux and Unix operating systems.

Malicious “dependency confusion” packages are published in the npm open source ecosystem used by software developers across the world, according to researchers with Sonotype, and are disguised as legitimate packages.

The malicious packages are deliberately named after repositories, namespaces, or components that companies such as Amazon, Zillow, Lyft, and Slack regularly use. These often have names such as ‘amzn’, ‘zg-rentals’, ‘lyft-dataset-sdk’, and ‘serverless-slack-app’.

As soon as these packages are installed automatically - because they share a name with a company’s legitimate dependency - they can exfiltrate sensitive data. One example involving the malicious ‘amzn’ package saw hackers deploy code to seize the etc/shadow file, which maintains hashed password data on Linux systems.

New Spectre exploits uploaded for Windows and Linux

Working exploits targeting the infamous Spectre vulnerability on Linux and Windows operating systems were recently uploaded to the VirusTotal platform.

The four-stage exploit could be triggered by hackers on systems that haven’t been patched against the three-year-old vulnerability to steal data, including sensitive files and passwords. A report published by researcher Julien Voisin claimed that users without privileges can extract password files from a target device, as well as authentication tickets that can be used to escalate privileges.

The Spectre flaw, tracked as CVE-2017-5753, was discovered by Google Project Zero researchers alongside Meltdown as a hardware-embedded vulnerability affecting a handful of modern processors. Manufacturers and software vendors have since moved to fix their systems against exploitation attempts, although devices that haven’t been patched may still be vulnerable to attack.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Most Popular

The top 12 password-cracking techniques used by hackers

The top 12 password-cracking techniques used by hackers

14 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation
cyber crime

Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation

25 Nov 2022