Week of February 13, 2023: Microsoft, Apple Patch Exploited Zero-Days; CISA Expands KEV List

Security leaders spent the week of February 13, 2023 pushing emergency patches after Microsoft and Apple each disclosed actively exploited zero-day vulnerabilities, while CISA added four more flaws to its Known Exploited Vulnerabilities Catalog and Citrix issued fixes for high-severity bugs in its Workspace and Virtual Apps products. A phishing campaign abusing Namecheap's email infrastructure and newly reported flaws in Korenix industrial access points also drew attention from defenders managing both IT and OT environments.

Microsoft February Patch Tuesday Fixes Three Exploited Zero-Days

Microsoft's February Patch Tuesday addressed 75 CVE-numbered vulnerabilities, including three flaws already under active exploitation: CVE-2023-21715, affecting Microsoft Publisher's macro-blocking protections; CVE-2023-23376, a Windows Common Log File System bug capable of granting SYSTEM privileges; and CVE-2023-21823, a Windows Graphics Component issue that could enable remote code execution. Microsoft did not release details on the specific attacks exploiting these bugs, but researchers urged administrators to apply the fixes without delay given the privilege-escalation and code-execution potential involved. (Help Net Security)

Apple Fixes Actively Exploited WebKit Zero-Day

Apple shipped security updates for iOS 16.3.1, iPadOS 16.3.1, macOS Ventura 13.2.1, and Safari 16.3.1 to close a WebKit type-confusion flaw tracked as CVE-2023-23529, which Apple said may have been exploited in attacks. The bug could let an attacker execute arbitrary code after a device processed maliciously crafted web content. Apple credited an anonymous researcher along with The Citizen Lab at the University of Toronto's Munk School, though it did not disclose further detail on how the vulnerability had been used against targets. (Help Net Security)

Citrix Patches High-Severity Flaws in Workspace and Virtual Apps

Citrix released updates addressing four high-severity vulnerabilities, CVE-2023-24486, CVE-2023-24484, CVE-2023-24485 and CVE-2023-24483, affecting Citrix Workspace Apps, Virtual Apps and Desktops. CISA warned that a local user could exploit the flaws to take control of an affected system and pointed administrators to Citrix's security bulletins for remediation steps. The disclosure added to a crowded week of enterprise software patching that security teams needed to track alongside Microsoft's and Apple's own zero-day fixes. (CISA)

Cisco Issues Advisories Covering ClamAV, Nexus Dashboard and Email Security Products

Cisco published security advisories covering a ClamAV HFS+ partition-scanning buffer overflow affecting Cisco products, a denial-of-service issue in Cisco Nexus Dashboard, and vulnerabilities in Cisco Email Security Appliance and Cisco Secure Email and Web Manager. CISA flagged the advisories and noted that a remote attacker could exploit some of the issues to take control of an affected system, directing administrators to Cisco's bulletins for applicable fixes across the three affected product lines. (CISA)

CISA Releases Fifteen Industrial Control Systems Advisories

CISA published fifteen ICS advisories in a single release, covering products from Siemens, including Solid Edge, SCALANCE X-200 IRT, SiPass integrated, Simcenter Femap, TIA Project Server, RUGGEDCOM APE1808, SIMATIC Industrial Products and COMOS, along with advisories for Sub-IoT's DASH 7 Alliance Protocol, an update to a prior Delta Electronic DIAEnergie advisory, and a medical device advisory for BD Alaris Infusion Central. The batch gave OT and ICS security teams a wide set of vendor-specific vulnerabilities and mitigations to review. (CISA)

Phishing Campaign Abuses Namecheap's Email Platform to Target Customers

Namecheap customers were hit with a wave of phishing emails impersonating DHL and MetaMask, attempting to harvest personal information and cryptocurrency wallet recovery phrases. The emails were sent through Namecheap's SendGrid account and were digitally signed with DKIM, making them appear legitimate. Namecheap said its own systems had not been breached and attributed the activity to the upstream SendGrid platform, which was also looking into the matter, while the company moved to suspend several categories of outgoing customer emails. (Help Net Security)

Researchers Disclose Vulnerabilities in Korenix JetWave Industrial Networking Devices

CyberDanube researchers disclosed three vulnerabilities, including two command injection flaws and one denial-of-web-service issue, affecting a range of Korenix JetWave industrial access points and LTE cellular gateways. The flaws required attacker authentication but could be reached through default credentials or sniffed network traffic, and successful exploitation could allow a reverse shell or persistent foothold on the device. Beijer Electronics, which manufactures the Korenix-branded hardware, confirmed the affected models and had released firmware fixes in January 2023 ahead of the public advisory. (Help Net Security)