Week of March 7, 2022: Dirty Pipe Patches and Google's $5.4B Mandiant Deal

Security leaders spent the week of March 7, 2022 absorbing CISA's Dirty Pipe and Russian MFA-bypass advisories alongside Microsoft's March Patch Tuesday and a fresh RagnarLocker ransomware alert, while Google's agreement to acquire Mandiant reshaped the incident-response and threat-intelligence market. Researchers also disclosed TLStorm flaws in widely deployed APC Smart-UPS devices and Mozilla pushed an emergency fix for two actively exploited Firefox zero-days.

CISA Warns of Dirty Pipe Linux Privilege Escalation Flaw

CISA published an alert on March 10, 2022 describing a privilege escalation vulnerability in the Linux kernel, tracked as CVE-2022-0847 and nicknamed Dirty Pipe, affecting kernel versions 5.8 and later. A local attacker could exploit the flaw to gain control of an affected system. The agency urged administrators to update to Linux kernel versions 5.16.11, 5.15.25, or 5.10.102 or later. Public proof-of-concept exploit code was already circulating, raising urgency for patching across Linux-based servers and Android devices used throughout enterprise environments. (CISA)

FBI and CISA Detail Russian MFA Bypass Techniques

On March 7, 2022, the FBI and CISA issued a joint advisory describing how Russian state-sponsored cyber actors demonstrated the ability to bypass multifactor authentication protocols. The advisory laid out observed tactics, techniques, procedures, and indicators of compromise that organizations could use to detect and block this activity. CISA pointed administrators toward its Russia Cyber Threat Overview and Shields Up guidance for additional mitigations, underscoring heightened concern among federal agencies about Russian cyber operations in the opening weeks of the war in Ukraine. (CISA)

CISA Adds 11 Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA added 11 vulnerabilities to its Known Exploited Vulnerabilities Catalog on March 7, 2022, including two Mozilla Firefox use-after-free bugs, a VMware vCenter Server server-side request forgery flaw, and older Adobe ColdFusion and NETGEAR router issues. Under Binding Operational Directive 22-01, federal civilian agencies faced a March 21, 2022 remediation deadline for the Firefox and VMware entries, while the remaining older vulnerabilities carried a September 7, 2022 deadline. CISA again urged all organizations, not just federal agencies, to prioritize remediation of catalog entries. (CISA)

FBI Issues RagnarLocker Ransomware Indicators of Compromise

The FBI released a Flash report on March 8, 2022, detailing indicators of compromise tied to RagnarLocker ransomware attacks against critical infrastructure sectors. CISA encouraged administrators to review the technical indicators and apply the recommended mitigations to detect and block the group's activity. The advisory added to a string of ransomware-focused guidance issued that week as federal agencies continued tracking groups capable of disrupting operational technology and essential services across multiple industries. (CISA)

Google Agrees to Acquire Mandiant for $5.4 Billion

Mandiant announced on March 8, 2022 that it had agreed to be acquired by Google in an all-cash transaction valued at approximately $5.4 billion, with Google offering $23.00 per share. Upon closing, Mandiant was set to join Google Cloud, combining its incident-response and threat-intelligence consulting business with Google Cloud's security portfolio. Mandiant, which has operated for 18 years and whose consultants respond to thousands of breaches annually, said the deal would extend its Mandiant Advantage platform through Google Cloud's infrastructure. (Help Net Security)

Mozilla Patches Two Firefox Zero-Days Exploited in the Wild

Mozilla shipped an out-of-band security update on March 7, 2022 for Firefox, Firefox Focus, and Thunderbird to fix two critical use-after-free vulnerabilities, CVE-2022-26485 and CVE-2022-26486, that were already being exploited by attackers. CVE-2022-26485 affected XSLT parameter processing and could enable remote code execution, while CVE-2022-26486 affected the WebGPU IPC framework and could allow a sandbox escape. CISA subsequently added both flaws to its Known Exploited Vulnerabilities Catalog, giving federal agencies a March 21, 2022 remediation deadline. (Help Net Security)

Microsoft's March Patch Tuesday Fixes 71 Vulnerabilities

Microsoft's March 2022 Patch Tuesday, issued March 8, 2022, addressed 71 CVE-numbered vulnerabilities, including a publicly known Remote Desktop Client remote code execution flaw, CVE-2022-21990, and a Microsoft Exchange Server RCE, CVE-2022-23277, that researchers flagged as likely exploitation targets. The batch also covered a Windows SMBv3 Client/Server RCE, CVE-2022-24508, marked by Microsoft as exploitation more likely, along with a spoofing vulnerability in Microsoft Defender for Endpoint. CISA encouraged administrators to review the update summary and apply patches promptly. (Help Net Security)

TLStorm Flaws Found in Widely Used APC Smart-UPS Devices

Armis researchers disclosed on March 8, 2022 three vulnerabilities, collectively dubbed TLStorm, in widely deployed APC Smart-UPS uninterruptible power supply devices made by Schneider Electric subsidiary APC. The flaws, CVE-2022-22805, CVE-2022-22806, and CVE-2022-0715, could let a remote attacker take over cloud-connected units without user interaction, execute code, and potentially overheat the hardware that backs up power for hospitals, data centers, and industrial facilities. Schneider Electric published a security advisory with remediation and mitigation guidance for affected customers. (Help Net Security)