Week of June 19, 2023: CISA KEV Additions and New Cybersecurity Division Leaders

Security leaders tracking the week of June 19, 2023 saw CISA add eleven actively exploited vulnerabilities, spanning Apple, VMware, Roundcube, Mozilla, and Microsoft products, to its Known Exploited Vulnerabilities Catalog across two alerts issued June 22 and 23. The same week brought a VMware vCenter Server security update, ISC BIND 9 and Juniper Junos OS advisories, four new ICS advisories, and the arrival of two new CISA Cybersecurity Division leaders, Andrew Scott and David Carroll.

CISA Adds Five Actively Exploited Flaws to KEV Catalog

On June 23, 2023, CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation, including three Apple WebKit and integer overflow flaws, a VMware Tools authentication bypass bug, and a Mozilla Firefox, Firefox ESR, and Thunderbird use-after-free vulnerability. Federal civilian agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching given the active exploitation evidence underlying the catalog additions. (CISA)

CISA Adds Six More KEVs, Including VMware Aria and Roundcube Bugs

On June 22, 2023, CISA added six more vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing active exploitation. The list included a VMware Aria Operations for Networks command injection flaw, three Roundcube Webmail vulnerabilities spanning cross-site scripting, remote code execution, and SQL injection, plus older Mozilla Firefox and Microsoft Win32k privilege escalation bugs. Federal civilian agencies were directed to remediate the vulnerabilities under Binding Operational Directive 22-01, with CISA again encouraging private-sector organizations to apply the same prioritization. (CISA)

VMware Patches Memory Corruption Flaws in vCenter Server

VMware issued a security update addressing multiple memory corruption vulnerabilities in vCenter Server and Cloud Foundation, flaws CISA said could let an attacker take control of an affected system. CISA published an alert on June 23, 2023 directing administrators to review VMware Security Advisory VMSA-2023-0014 and apply the patches. The advisory arrived the same week CISA separately added a related VMware Tools authentication bypass bug to its Known Exploited Vulnerabilities Catalog. (CISA)

Apple Ships Security Updates Across iOS, macOS, and watchOS

Apple released security updates on June 22, 2023 covering watchOS, macOS Big Sur, Monterey and Ventura, and iOS/iPadOS across multiple version branches, patching vulnerabilities CISA warned could let an attacker take control of an affected device. CISA's alert listed updates spanning watchOS 8.8.1 and 9.5.2, macOS Big Sur 11.7.8, Monterey 12.6.7 and Ventura 13.4.1, and iOS/iPadOS 15.7.7 and 16.5.1. CISA added three of the underlying WebKit and integer overflow flaws to its Known Exploited Vulnerabilities Catalog the following day. (CISA)

ISC Patches Denial-of-Service Flaws in BIND 9

The Internet Systems Consortium released security advisories on June 22, 2023 for multiple versions of BIND 9, its widely used Domain Name System software, covering three vulnerabilities tracked as CVE-2023-2828, CVE-2023-2829, and CVE-2023-2911. CISA said a remote attacker could exploit the flaws to cause denial-of-service conditions and encouraged administrators running BIND 9 to review the ISC advisories and apply the necessary mitigations given the software's prevalence across enterprise and service-provider DNS infrastructure. (CISA)

Juniper Warns of Denial-of-Service Flaw in Junos OS

Juniper Networks published a security advisory on June 22, 2023 addressing a vulnerability in Junos OS and Junos OS Evolved tracked as CVE-2023-0026, which CISA said a remote attacker could exploit to cause a denial-of-service condition. CISA urged users and administrators of the affected Juniper platforms to review the vendor advisory and apply the necessary updates, grouping the notice alongside several other network and security-product advisories issued the same day. (CISA)

CISA Names Andrew Scott and David Carroll to Cybersecurity Division

CISA announced two additions to its Cybersecurity Division on June 22, 2023, naming Andrew Scott as Associate Director for China Operations and David Carroll as Associate Director for Mission Engineering. Scott previously served at the White House as Special Assistant to the President and Senior Director for Cyber Policy, while Carroll joined from Google and brought experience across cloud, mobile, and virtual-environment security work, including an assignment at NATO. (CISA)

CISA Issues Four Industrial Control Systems Advisories

CISA released four Industrial Control Systems advisories on June 22, 2023 covering Advantech R-SeeNet, SpiderControl SCADAWebServer, an updated Econolite EOS advisory, and an updated Mitsubishi Electric MELSEC iQ-F Series advisory. CISA encouraged asset owners and operators running the affected ICS products to review the technical details and apply the recommended mitigations, part of a steady cadence of ICS-focused advisories issued across the week for products used in transportation, building automation, and industrial monitoring systems. (CISA)