Week of October 9, 2023: HTTP/2 Rapid Reset Fallout and Citrix NetScaler Flaws

Security leaders faced a wave of urgent patching guidance the week of October 9, 2023, as CISA and Microsoft disclosed actively exploited zero-days alongside the widely exploited HTTP/2 Rapid Reset DDoS vulnerability. CISA also updated ransomware guidance for AvosLocker and flagged critical Citrix NetScaler flaws, while curl's maintainers previewed a high-severity fix affecting billions of installations.

CISA Warns on HTTP/2 Rapid Reset DDoS Vulnerability

On October 10, 2023, CISA published an alert on CVE-2023-44487, the HTTP/2 "Rapid Reset" denial-of-service vulnerability, warning that it had been exploited in the wild from August through October 2023. The flaw let attackers rapidly open and cancel HTTP/2 streams to overwhelm servers. CISA urged organizations offering HTTP/2 services to apply vendor patches and configuration mitigations, pointing administrators to guidance from Cloudflare, Google, AWS, NGINX, and Microsoft on limiting exposure to the technique. (CISA)

CISA Adds Five Actively Exploited Flaws to KEV Catalog

CISA added five vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 10, 2023, citing evidence of active exploitation. The list included CVE-2023-21608 in Adobe Acrobat and Reader, CVE-2023-20109 in Cisco IOS and IOS XE, CVE-2023-41763 in Microsoft Skype for Business, CVE-2023-36563 in Microsoft WordPad, and the HTTP/2 Rapid Reset flaw CVE-2023-44487. Under Binding Operational Directive 22-01, federal civilian agencies were required to remediate these vulnerabilities by set deadlines, and CISA urged all organizations to prioritize the fixes. (CISA)

Citrix Patches NetScaler ADC and Gateway Vulnerabilities

Citrix released security updates on October 10, 2023 addressing vulnerabilities across multiple products, including NetScaler ADC and NetScaler Gateway flaws tracked as CVE-2023-4966 and CVE-2023-4967, along with separate fixes for Citrix Hypervisor. CISA's alert warned that a malicious cyber actor could exploit one of the vulnerabilities to take control of an affected system and directed administrators to Citrix's security bulletins for patching details and further guidance. (CISA)

Microsoft Fixes Three Actively Exploited Zero-Days in October Patch Tuesday

On its October 2023 Patch Tuesday, Microsoft shipped 103 patches and fixed three actively exploited vulnerabilities: CVE-2023-36563, a WordPad flaw that could let attackers grab NTLM hashes; CVE-2023-41763, an elevation-of-privilege bug in Skype for Business; and CVE-2023-44487, the HTTP/2 Rapid Reset DDoS vulnerability. Microsoft also announced that VBScript, long abused for malware distribution, would be deprecated in future Windows releases and eventually removed from the operating system. (Help Net Security)

Curl Maintainers Preview High-Severity Vulnerability Fix

Ahead of an October 11, 2023 release, curl's lead developer Daniel Stenberg previewed two vulnerabilities, CVE-2023-38545 and CVE-2023-38546, warning that the more severe flaw "is probably the worst curl security flaw in a long time." The high-severity SOCKS5 heap buffer overflow and a low-severity cookie-injection bug were fixed in curl 8.4.0, and researchers urged organizations to inventory every system running curl or libcurl, including embedded devices and Docker images, given the library's use in billions of installations. (Help Net Security)

CISA Links Known Exploited Vulnerabilities to Ransomware Campaigns

CISA launched two new resources on October 12, 2023 under its Ransomware Vulnerability Warning Pilot, adding a "Known to be Used in Ransomware Campaigns" column to the Known Exploited Vulnerabilities Catalog and publishing a companion table of misconfigurations and weaknesses tied to ransomware on StopRansomware.gov. The agency said the pilot had already initiated notifications for over 800 vulnerable systems and encouraged organizations to review the new resources and apply applicable mitigations. (CISA)