Week of August 21, 2023: WinRAR zero-day exploited, Seiko hit by ALPHV ransomware

Security leaders faced a cluster of actively exploited vulnerabilities in the week of August 21, 2023, as CISA added five CVEs affecting WinRAR, Openfire, Ivanti Sentry, and Veeam to its Known Exploited Vulnerabilities Catalog while Group-IB detailed a WinRAR zero-day used since April to drain trader brokerage accounts. Seiko's data breach was claimed by the ALPHV/BlackCat ransomware group, Juniper Networks patched a chainable remote-code-execution flaw in its firewalls and switches, and MITRE named a new chief information officer.

CISA adds WinRAR and Openfire flaws to KEV Catalog

CISA added CVE-2023-38831, a RARLAB WinRAR code execution vulnerability, and CVE-2023-32315, an Ignite Realtime Openfire path traversal vulnerability, to its Known Exploited Vulnerabilities Catalog on August 24, 2023, citing evidence of active exploitation. The addition triggered Binding Operational Directive 22-01 remediation deadlines for Federal Civilian Executive Branch agencies and signaled to CISOs that both flaws already had confirmed in-the-wild attacks. CISA urged all organizations, not just federal agencies, to prioritize patching in their vulnerability management programs given the flaws' history as attack vectors. (CISA)

Ivanti Sentry and Veeam bugs added to KEV Catalog

On August 22, 2023, CISA added CVE-2023-38035, an Ivanti Sentry authentication bypass vulnerability, and CVE-2023-27532, a Veeam Backup & Replication Cloud Connect missing-authentication flaw, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Both products are widely deployed in enterprise environments, making the additions notable for teams managing mobile device gateways and backup infrastructure. CISA's Binding Operational Directive 22-01 required federal civilian agencies to remediate the two vulnerabilities by set deadlines, while the agency again encouraged broader industry adoption of the catalog for prioritization. (CISA)

CISA releases six ICS advisories covering major vendors

CISA released six Industrial Control Systems advisories on August 24, 2023, covering products from KNX, Opto 22, CODESYS, and Rockwell Automation input/output modules. The advisories provided technical detail on current security issues, vulnerabilities, and exploits affecting ICS environments used across manufacturing, energy, and other critical infrastructure sectors. CISA encouraged asset owners and administrators to review the mitigations in each advisory, part of the agency's continuing effort to keep operational technology defenders informed of newly disclosed weaknesses in widely used industrial equipment and software. (CISA)

Ivanti Sentry zero-day flaw draws urgent patch guidance

Ivanti urged administrators of Ivanti Sentry gateways to patch CVE-2023-38035, an API authentication bypass flaw that could let attackers change configuration, run system commands, or write files to affected systems. The company said it was initially aware of a limited number of impacted customers, while researchers with Mnemonic described the flaw as a zero-day affecting the MICS Admin Portal in versions 9.18.0 and below. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on August 23, 2023, and Horizon3.ai later published analysis of Ivanti's patch along with a proof-of-concept exploit. (Help Net Security)

WinRAR zero-day used since April to steal from broker accounts

Group-IB reported that financially motivated attackers had exploited a WinRAR zero-day, CVE-2023-38831, since April 2023 to trick traders into installing malware that stole money from broker accounts. The file-extension spoofing flaw let attackers craft RAR or ZIP archives containing a decoy file alongside malicious scripts sharing the same name. Devices belonging to at least 130 traders were infected with DarkMe, GuLoader, or Remcos RAT malware distributed through online trading forums. RARLAB fixed the flaw in WinRAR version 6.23, released alongside a separate high-severity remote code execution patch. (Help Net Security)

Seiko data breach claimed by ALPHV/BlackCat ransomware group

Japanese watchmaker Seiko was added to the ALPHV/BlackCat ransomware group's victim list on August 21, 2023, after the group published data samples on its leak site tied to a breach the company disclosed on August 10. Seiko said external cybersecurity experts engaged on August 2 had confirmed that an unidentified party gained unauthorized access to at least one server, with some stored information potentially compromised. The company urged customers and partners to treat unsolicited communications with caution while its investigation into the scope of the incident continued. (Help Net Security)

MITRE names Deborah Youmans as chief information officer

MITRE named Deborah Youmans as its new chief information officer on August 22, 2023, giving her oversight of more than 400 IT professionals across the organization's Enterprise Computing and Information Systems division, including information security, enterprise technology, and business services functions. Youmans joined MITRE from Booz Allen Hamilton, where she served as vice president and deputy CIO leading a team of more than 500 people delivering enterprise solutions to the firm's 30,000 users. MITRE's SVP for enterprise innovation and integration said her experience would support the organization's IT capabilities going forward. (Help Net Security)

Juniper patches chainable RCE flaws in firewalls and switches

Juniper Networks fixed four Junos OS vulnerabilities, CVE-2023-36844 through CVE-2023-36847, disclosed August 22, 2023, that could be chained together to achieve remote code execution on the company's SRX firewalls and EX switches. Individually the flaws scored 5.3 on the CVSS scale, but combined exploitation reached a 9.8 critical rating, according to Juniper's advisory. The company released patched Junos OS versions for both SRX and EX Series devices and recommended administrators update immediately or mitigate risk by disabling the J-Web interface or restricting access to trusted hosts. (Help Net Security)