Week of August 7, 2023: Barracuda Backdoors and August Patch Tuesday

Security leaders faced a dense advisory calendar during the week of August 7, 2023, as CISA published a malware analysis of the SEASPY and WHIRLPOOL backdoors tied to the Barracuda ESG zero-day, added two vulnerabilities to its Known Exploited Vulnerabilities Catalog, and released twelve Siemens ICS advisories, while Microsoft, Adobe, and Fortinet issued patches for targeted software. The same week, CISA and FEMA opened applications for $374.9 million in state and local cybersecurity grants, underscoring continued federal investment in public-sector defense.

CISA Adds Zyxel Router Flaw to Known Exploited Vulnerabilities Catalog

On August 7, 2023, CISA added a command injection vulnerability affecting Zyxel P660HN-T1A routers, tracked as CVE-2017-18368, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The listing obligated federal civilian agencies to remediate under Binding Operational Directive 22-01, while CISA encouraged all organizations to prioritize the fix. The addition served as a reminder that aging consumer-grade networking equipment can remain an active attack vector years after its initial vulnerability disclosure, particularly for organizations that have not retired legacy edge devices from their networks. (CISA)

Microsoft .NET Core Denial-of-Service Flaw Added to KEV Catalog

Two days later, on August 9, 2023, CISA added a second vulnerability to its Known Exploited Vulnerabilities Catalog: CVE-2023-38180, a denial-of-service flaw in Microsoft .NET Core and Visual Studio. The catalog entry, made under Binding Operational Directive 22-01, required Federal Civilian Executive Branch agencies to remediate the flaw by its due date. CISA reiterated that these vulnerability types remain frequent attack vectors and pose significant risk to federal networks, pressing all organizations, not only federal agencies, to prioritize patching development toolchains exposed to this denial-of-service issue. (CISA)

August 2023 Patch Tuesday Fixes 76 CVEs, Including Actively Exploited .NET Bug

Microsoft's August 2023 Patch Tuesday, released August 8, 2023, addressed 76 CVE-numbered issues, including the .NET and Visual Studio denial-of-service flaw that CISA added to its KEV catalog the following day. The release also included an Office defense-in-depth update tied to a previously exploited Windows Search remote code execution bug, an Exchange Server elevation-of-privilege flaw researchers considered more severe than its rating suggested, and eleven fixes for Microsoft Message Queuing, a service one CISO noted carries critical risk wherever it remains enabled. (Help Net Security)

Adobe Patches Acrobat, Commerce, Dimension and XMP Toolkit SDK

Adobe issued security updates on August 8, 2023 covering Acrobat and Reader, Commerce, Dimension, and the XMP Toolkit SDK, addressing multiple vulnerabilities that CISA warned could let an attacker take control of an affected system. The bulletins spanned document-handling software widely deployed in enterprises as well as Adobe's e-commerce platform, giving CISOs cause to coordinate patching across both endpoint productivity tools and customer-facing commerce infrastructure within the same release window. (CISA)

Fortinet Patches FortiOS Vulnerability Allowing System Takeover

Fortinet released a security update on August 8, 2023 for FortiOS addressing CVE-2023-29182, a vulnerability that CISA said a remote attacker could exploit to take control of an affected system. Given FortiOS's role underpinning firewalls and VPN gateways at the network perimeter, CISA pointed administrators to Fortinet's FG-IR-23-149 advisory and urged prompt application of the update to reduce exposure of internet-facing devices commonly targeted by opportunistic attackers. (CISA)

CISA Details SEASPY and WHIRLPOOL Backdoors From Barracuda ESG Compromise

CISA published a malware analysis report on August 9, 2023 detailing SEASPY and WHIRLPOOL, backdoors recovered from a Barracuda Email Security Gateway appliance compromised through CVE-2023-2868, a former zero-day affecting versions 5.1.3.001 through 9.2.0.006. SEASPY masqueraded as a legitimate Barracuda mail service to execute arbitrary commands, while WHIRLPOOL opened a TLS reverse shell to a command-and-control server. The report gave defenders indicators of compromise and YARA rules to hunt for the same backdoor family across affected ESG deployments. (CISA)

CISA Releases Twelve Siemens Industrial Control Systems Advisories

CISA released twelve industrial control systems advisories on August 10, 2023, all concerning Siemens products, including Solid Edge, JT2Go and Teamcenter Visualization, the Parasolid installer, JT Open and JT Utilities, Software Center, RUGGEDCOM CROSSBOW, SIMATIC address processing, and SICAM TOOLBOX II. The advisories detailed current vulnerabilities and exploits affecting operational technology environments, giving asset owners technical mitigation guidance for a broad slate of engineering, visualization, and substation automation software used across manufacturing and energy sector control networks. (CISA)

CISA and FEMA Open $374.9 Million State and Local Cybersecurity Grant Round

CISA and FEMA opened applications on August 7, 2023 for $374.9 million in Year 2 funding under the State and Local Cybersecurity Grant Program, part of a four-year, $1 billion program created under the Bipartisan Infrastructure Investment and Jobs Act. Applicants were encouraged to build on cybersecurity plans developed with FY22 funds, with this year's focus areas including assessing current postures, ensuring personnel training, and implementing protections commensurate with risk, ahead of an October 6 application deadline. (CISA)