Week of September 11, 2023: KEV Adds Apple & Chrome Flaws; CISA Issues OSS Roadmap

The week of September 11, 2023 brought a cluster of actively exploited vulnerabilities into CISA's Known Exploited Vulnerabilities Catalog, spanning Apple's iOS and watchOS, Google Chrome, Cisco's ASA and FTD platforms, and Android, alongside Microsoft and Adobe zero-day patches addressed in September's Patch Tuesday. CISA also published its Open Source Software Security Roadmap and joined the NSA and FBI in issuing guidance on deepfake threats, while new survey data highlighted growing board-level concern about cyberattack risk and researchers disclosed email forwarding flaws that could enable domain spoofing.

CISA Adds Actively Exploited Apple Vulnerabilities to KEV Catalog

On September 11, 2023, CISA added two Apple vulnerabilities, CVE-2023-41064 and CVE-2023-41061, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. The flaws affected iOS, iPadOS, macOS, and watchOS, with one enabling buffer overflow through ImageIO and the other allowing code execution via the Wallet app. Federal civilian agencies faced a mandated remediation deadline under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize patching given the vulnerabilities' inclusion in a list of flaws carrying significant risk to networks. (CISA)

Microsoft and Adobe Patch Actively Exploited Zero-Days in September Update

Microsoft's September 2023 Patch Tuesday addressed 61 CVE-numbered flaws, including CVE-2023-36761, an information disclosure bug in Word that researchers said could trigger merely by previewing a file, and CVE-2023-36802, an elevation of privilege flaw in Microsoft Streaming Service Proxy, both already exploited by attackers. Adobe simultaneously fixed CVE-2023-26369, a critical out-of-bounds write vulnerability in Acrobat and Reader exploited in limited attacks. Security researchers flagged the Word bug's ability to expose NTLM hashes as a priority for rapid deployment across enterprise environments. (Help Net Security)

CISA Adds Chrome, Cisco, and Android Flaws to KEV Catalog

On September 13, 2023, CISA added three more actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog: a Google Chrome heap-based buffer overflow, a Cisco Adaptive Security Appliance and Firepower Threat Defense unauthorized access flaw, and an Android Framework privilege escalation bug. Federal civilian agencies were required to remediate the vulnerabilities by CISA's specified deadlines under Binding Operational Directive 22-01. The additions reflected an active week of exploitation across widely deployed browser, network appliance, and mobile platform software that security teams needed to track alongside other September patches. (CISA)

Fortinet Patches Vulnerabilities Enabling System Takeover in FortiOS, FortiProxy, FortiWeb

Fortinet released security updates on September 15, 2023 addressing CVE-2023-29183 and CVE-2023-34984, vulnerabilities affecting FortiOS, FortiProxy, and FortiWeb that could let a threat actor take control of an affected system. CISA pointed administrators to Fortinet's advisories FG-IR-23-106 and FG-IR-23-068 for technical detail and urged prompt patching. The disclosure added to a run of vendor advisories that week affecting network security appliances widely used in enterprise perimeters, giving CISOs another item to track alongside Microsoft, Adobe, and Mozilla updates issued in the same period. (CISA)

CISA Publishes Open Source Software Security Roadmap

CISA published its Open Source Software Security Roadmap on September 12, 2023, outlining four goals for fiscal years 2024 through 2026: establishing the agency's role in supporting open source security, driving visibility into usage and risks, reducing risk to the federal government, and hardening the broader open source ecosystem. Executive Assistant Director for Cybersecurity Eric Goldstein said vulnerable or malicious open source software could introduce systemic risks to the economy. CISA announced the roadmap at the Secure Open Source Summit hosted by the Open Source Security Foundation. (CISA)

NSA, FBI, and CISA Issue Guidance on Deepfake Threats

On September 12, 2023, the National Security Agency, the FBI, and CISA jointly released a Cybersecurity Information Sheet titled Contextualizing Deepfake Threats to Organizations, covering synthetic media techniques and trends affecting national security systems, the Defense Industrial Base, and critical infrastructure operators. The agencies pointed to disinformation operations built on synthetic media as a growing concern for organizations and urged security teams to review recommended steps for preparing for, identifying, defending against, and responding to deepfake-enabled attacks. (CISA)

Survey Finds Board Concern Over Cyberattack Risk Rising

A Proofpoint survey published September 11, 2023 found 73% of board members believed their organization faced risk of a major cyberattack in the next 12 months, up from 65% the prior year, while 53% felt unprepared to cope with a targeted attack. Board members ranked malware as their top concern, followed by insider threat and cloud account compromise, mirroring worries reported by CISOs. Proofpoint's Ryan Kalember said the closer alignment between boards and CISOs had not yet translated into measurable improvements in cybersecurity posture. (Help Net Security)

Researchers Detail Email Forwarding Flaws Enabling Domain Spoofing

University of California San Diego researchers published findings on September 11, 2023 showing that flaws in email forwarding protocols allowed attackers to impersonate high-profile domains, including state.gov and news organizations such as the Associated Press, by exploiting the way third-party providers like Outlook and Gmail validate forwarded mail. The team found more than 12% of the top 100,000 internet domains and 32% of .gov domains vulnerable to the technique. Microsoft, Google, and Zoho received disclosures, with some fixes and bug bounties issued while other providers continued investigating. (Help Net Security)