Week of August 29, 2022: Apple Patches Exploited iOS Flaw, CISA Issues ICS Advisories

Security leaders tracked CISA's disclosure of an actively exploited Apple iOS vulnerability alongside fourteen industrial-control-system advisories covering vendors from Hitachi Energy to Delta Electronics, while Atlassian confirmed a critical Bitbucket command-injection flaw and Resecurity reported Thai health data for sale on Dark Web marketplaces. CISA, NSA, and ODNI also released the first installment of joint guidance on securing the software supply chain, rounding out a week centered on patch triage and infrastructure risk.

Apple Patches Actively Exploited iOS Vulnerability

On September 1, 2022, CISA flagged Apple security updates addressing CVE-2022-32893, affecting iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad mini 2, iPad mini 3, and iPod touch (6th generation). Exploitation could let an attacker take control of an affected device. CISA urged administrators to review Apple's advisory HT213428 and apply the necessary updates, underscoring the continuing exposure that older iOS hardware still present in enterprise device fleets posed to security teams managing mobile risk. (CISA)

CISA Publishes Twelve Industrial Control Systems Advisories

On August 30, 2022, CISA released twelve Industrial Control Systems advisories covering products from Hitachi Energy, Honeywell, Fuji Electric, Omron, PTC, and Sensormatic Electronics, plus an update to a prior Mitsubishi Electric advisory. The advisories detailed current security issues, vulnerabilities, and exploits affecting operational technology used across manufacturing, energy, and building-management environments, giving CISOs overseeing critical infrastructure a fresh batch of vendor-specific mitigations to work through heading into September. (CISA)

CISA, NSA, and ODNI Issue Part One of Supply Chain Guidance

On September 2, 2022, CISA, the NSA, and ODNI published the first of a three-part series called Securing Software Supply Chain Series - Recommended Practices for Developers. Produced by the Enduring Security Framework, a public-private working group led by NSA and CISA, the guidance targeted software developers with practices meant to strengthen the software supply chain. CISA encouraged acquiring organizations, software suppliers, and network operators to review the guidance and weigh its recommendations against existing vendor risk programs. (CISA)

Mozilla Patches Thunderbird Vulnerability

On September 2, 2022, CISA highlighted a Mozilla security update fixing a vulnerability in Thunderbird that could let an attacker take control of an affected system. CISA advised users and administrators to consult the Mozilla security advisory for Thunderbird 102.2.1 and apply the update, adding another patch-management item for enterprise messaging teams already working through a heavy stretch of advisories that week. (CISA)

Critical Command Injection Flaw Disclosed in Atlassian Bitbucket

On August 29, 2022, researchers disclosed CVE-2022-36804, a critical command injection vulnerability in multiple API endpoints of Atlassian Bitbucket Server and Data Center that unauthorized attackers could exploit to execute malicious code on vulnerable instances. All self-hosted versions released before 7.6.17, 7.17.10, 7.21.4, 8.0.3, 8.1.2, 8.2.2, and 8.3.1 were affected, though Bitbucket installations hosted by Atlassian itself were not. Atlassian urged self-hosted customers to upgrade promptly given the vulnerability's severity. (Help Net Security)

Thailand COVID-19 Patient Data Surfaces on Dark Web

On August 29, 2022, Resecurity reported that personal data stolen from Thailand's Department of Medical Sciences, covering citizens with COVID-19 symptoms, appeared for sale on Dark Web marketplaces and through a Telegram channel. The access reportedly resulted from an SQL injection vulnerability in an online-survey web application's authorization module. Resecurity said at least 5,151 detailed records were confirmed exposed, with potential exposure of up to 15,000 records, and shared the leaked data with Thai CERT and relevant authorities. (Help Net Security)

CISA Adds Two More ICS Advisories for Medical and Industrial Software

On September 1, 2022, CISA released two additional Industrial Control Systems advisories: ICSMA-22-244-01 covering the Contec CMS8000 patient monitoring device and ICSA-22-244-01 covering Delta Electronics DOPSoft software. The advisories provided technical details and mitigations for current vulnerabilities and exploits affecting the two products, giving CISOs responsible for healthcare and industrial automation environments additional guidance to fold into patch planning alongside the larger advisory batch issued two days earlier. (CISA)