Weekly threat roundup: Microsoft Exchange, Chrome, Spectre

Pulling together the most dangerous and pressing flaws that businesses need to patch

Patch management is far easier said than done, and security teams may often be forced into prioritising fixes for several business-critical systems, all released at once. It’s become typical, for example, to expect dozens of patches to be released on Microsoft’s Patch Tuesday, with other vendors also routinely getting in on the act.

Below, IT Pro has collated the most pressing disclosures from the last seven days, including details such as a summary of the exploit mechanism, and whether the vulnerability is being exploited in the wild. This is in order to give teams a sense of which bugs and flaws might pose the most dangerous immediate security risks.

Four exploited zero-days in Microsoft Exchange Server

State-backed hackers operating out of China are actively exploiting four critical zero-day vulnerabilities in Microsoft’s Exchange mail servers.

The vulnerabilities tracked as CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 are embedded in Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019, with Exchange Online unaffected.

Microsoft claims that the attackers are exploiting these flaws as part of a chain attack, with the initial attack demanding the ability to make an untrusted connection to Exchange server port 443. Businesses can protect against the attack by setting up a VPN to separate the Exchange server from external access, or by restricting untrusted connections.

This mitigation will only work against the initial phase of the attack, with hackers able to trigger other attacks along the chain if they already have access. As such, the firm has advised businesses to update their Exchange Server installations immediately.

Google fixes actively exploited Chrome flaw

Google has patched a series of flaws in its Chrome browser including the severe CVE-2021-21166, described as an “object lifecycle issue in audio” which is under exploitation by cyber criminals.

This is the fifth vulnerability discovered this week being actively exploited, and was patched alongside 32 other Chrome flaws in version 89.0.4389.72 of the browser. These included eight high-risk vulnerabilities.

It was first discovered by Alison Huffman, who works with Microsoft’s browser vulnerability research team. She also reported two additional high-risk flaws tagged CVE-2021-21165 and CVE-2021-21163. The former was also described as an “object lifecycle issue in audio” while the latter involved “insufficient data validation in Reader Mode”.

Malicious code found in JavaScript repositories

Hackers have placed malicious code in JavaScript repositories that could allow them to steal password files in Linux and Unix operating systems.

Malicious “dependency confusion” packages are published in the npm open source ecosystem used by software developers across the world, according to researchers with Sonotype, and are disguised as legitimate packages.

The malicious packages are deliberately named after repositories, namespaces, or components that companies such as Amazon, Zillow, Lyft, and Slack regularly use. These often have names such as ‘amzn’, ‘zg-rentals’, ‘lyft-dataset-sdk’, and ‘serverless-slack-app’.

As soon as these packages are installed automatically - because they share a name with a company’s legitimate dependency - they can exfiltrate sensitive data. One example involving the malicious ‘amzn’ package saw hackers deploy code to seize the etc/shadow file, which maintains hashed password data on Linux systems.

New Spectre exploits uploaded for Windows and Linux

Working exploits targeting the infamous Spectre vulnerability on Linux and Windows operating systems were recently uploaded to the VirusTotal platform.

The four-stage exploit could be triggered by hackers on systems that haven’t been patched against the three-year-old vulnerability to steal data, including sensitive files and passwords. A report published by researcher Julien Voisin claimed that users without privileges can extract password files from a target device, as well as authentication tickets that can be used to escalate privileges.

The Spectre flaw, tracked as CVE-2017-5753, was discovered by Google Project Zero researchers alongside Meltdown as a hardware-embedded vulnerability affecting a handful of modern processors. Manufacturers and software vendors have since moved to fix their systems against exploitation attempts, although devices that haven’t been patched may still be vulnerable to attack.

Featured Resources

Defeating ransomware with unified security from WatchGuard

How SMBs can defend against the onslaught of ransomware attacks

Free download

The IT expert’s guide to AI and content management

How artificial intelligence and machine learning could be critical to your business

Free download

The path to CX excellence

Four stages to thrive in the experience economy

Free download

Becoming an experience-based business

Your blueprint for a strong digital foundation

Free download

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021

Most Popular

What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

8 Sep 2021
Zoom: From pandemic upstart to hybrid work giant
video conferencing

Zoom: From pandemic upstart to hybrid work giant

14 Sep 2021
Citrix mulling potential sale after tumultuous 2021
mergers and acquisitions

Citrix mulling potential sale after tumultuous 2021

15 Sep 2021