Week of October 2, 2023: NSA-CISA misconfigurations advisory, Confluence zero-day added to KEV

Security leaders faced a dense advisory week: NSA and CISA published a joint top-ten misconfigurations report while Atlassian's Confluence privilege-escalation flaw, an actively exploited Apple iOS kernel bug, and a critical WS_FTP Server vulnerability all landed on CISA's Known Exploited Vulnerabilities Catalog. Qualcomm and Arm each disclosed and patched GPU driver zero-days flagged as targeted attacks, and ESET revealed a Lazarus Group espionage campaign against a Spanish aerospace firm built around a new remote access trojan called LightlessCan.

NSA and CISA Detail Top Ten Cybersecurity Misconfigurations

On October 5, 2023, the National Security Agency and CISA published a joint cybersecurity advisory identifying the ten most common network misconfigurations found in large organizations, drawn from years of red team, blue team, and hunt operations across federal, state, and private-sector networks. The advisory detailed tactics attackers use to exploit weak configurations such as default credentials, poor patch management, and insufficient network segmentation, and urged software manufacturers to adopt secure-by-design principles including eliminating default passwords and mandating phishing-resistant multifactor authentication for privileged users. (CISA)

Atlassian Confluence Privilege-Escalation Flaw Added to CISA's KEV Catalog

On October 5, 2023, Atlassian issued a security advisory for a privilege escalation vulnerability, tracked as CVE-2023-22515, affecting Confluence Data Center and Confluence Server. CISA warned that a remote threat actor could exploit the flaw to take control of an affected system and added the vulnerability to its Known Exploited Vulnerabilities Catalog the same day based on evidence of active exploitation. CISA urged administrators running on-premises Confluence deployments to apply Atlassian's updates without delay to prevent further compromise of internet-facing instances. (CISA)

Apple Patches Actively Exploited iOS and iPadOS Kernel Flaw

Apple released iOS 17.0.3 and iPadOS 17.0.3 on October 6, 2023, addressing vulnerabilities that could let a threat actor take control of an affected device. CISA flagged the update in an alert the same day, encouraging users and administrators to review Apple's advisory and apply the fix promptly given the risk that a remote attacker could gain full control of an iPhone or iPad running the affected software. (CISA)

Critical WS_FTP Server Vulnerability Confirmed Under Active Exploitation

CISA added a critical WS_FTP Server deserialization vulnerability, CVE-2023-40044, to its Known Exploited Vulnerabilities Catalog on October 5, 2023, alongside the Confluence and Apple flaws, after confirming active exploitation. The addition reflected reports that unauthenticated attackers had been executing remote commands on the Progress Software file-transfer product, prompting warnings for organizations running on-premises WS_FTP servers to apply the vendor's patched releases without delay to prevent further compromise. (CISA)

Qualcomm Patches Three Actively Exploited GPU and DSP Zero-Days

Qualcomm disclosed on October 4, 2023, that it had patched three actively exploited zero-day vulnerabilities, CVE-2023-33106, CVE-2023-33107, and CVE-2023-33063, in its Adreno GPU and Compute DSP drivers after Google's Threat Analysis Group and Project Zero found evidence the flaws were being exploited in limited, targeted attacks. The company notified device makers with a strong recommendation to deploy the security updates as soon as possible, and disclosed 17 additional vulnerabilities in the same bulletin, three of them rated critical. (Help Net Security)

Arm Fixes Mali GPU Zero-Day Exploited in Targeted Attacks

Arm confirmed on October 3, 2023, that a vulnerability in its Mali GPU kernel drivers, CVE-2023-4211, "may be under limited, targeted exploitation," and released updated drivers with patches the same day. The flaw affects Midgard, Bifrost, Valhall, and Arm's 5th Gen GPU Architecture kernel drivers used across many Android phones and tablets from vendors including Google, Samsung, and Xiaomi. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on October 3, 2023, and credited Google's Threat Analysis Group and Project Zero researchers with reporting it. (Help Net Security)

Lazarus Group's Fake Meta Recruiter Breach of Spanish Aerospace Firm Disclosed

ESET researchers disclosed on October 2, 2023, that the North Korea-linked Lazarus group had gained initial access to a Spanish aerospace company's network the previous year by having an operative pose as a Meta recruiter on LinkedIn and send fake coding challenges to an employee. The report detailed a previously undocumented remote access trojan named LightlessCan, which ESET said represented a significant advancement over Lazarus's earlier BlindingCan malware and was designed for cyberespionage against the targeted company. (Help Net Security)

CISA and NSA Issue New Identity and Access Management Guidance for Vendors

CISA and the NSA published new guidance on October 4, 2023, through the Enduring Security Framework, addressing identity and access management challenges facing developers and technology manufacturers. The publication built on earlier best-practices guidance for administrators and focused on technology gaps limiting adoption of multifactor authentication and single sign-on within organizations. CISA encouraged security teams to review the recommendations and raise them directly with software vendors as part of ongoing efforts to reduce identity-based attack surface across large and small organizations alike. (CISA)