Week of September 9, 2024: SonicWall, Ivanti flaws exploited; Microsoft patches four zero-days

Security leaders faced active exploitation of a SonicWall SonicOS flaw and an Ivanti Cloud Services Appliance bug, while Microsoft's September Patch Tuesday closed four zero-days already used in attacks. CISA and the FBI also warned that claims of hacked voter databases were likely disinformation, as new industry research showed cybersecurity budget growth slowing to single digits.

CISA adds exploited SonicWall SonicOS flaw to KEV catalog

CISA added CVE-2024-40766, an improper access control vulnerability affecting SonicWall SonicOS, to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. The same update included CVE-2016-3714, an ImageMagick input validation flaw, and CVE-2017-1000253, a Linux kernel stack buffer corruption bug. Under Binding Operational Directive 22-01, Federal Civilian Executive Branch agencies were required to remediate catalog entries by a specified due date to protect their networks against active threats, and CISA urged all organizations to prioritize timely remediation of catalog vulnerabilities as part of routine vulnerability management. (CISA)

Microsoft's September Patch Tuesday fixes four exploited zero-days

Microsoft's September Patch Tuesday delivered 79 fixes, including four zero-day vulnerabilities already exploited by attackers: CVE-2024-38217, CVE-2024-38226, CVE-2024-38014, and CVE-2024-43461. CVE-2024-38217 allowed attackers to bypass Mark of the Web protections using crafted Windows shortcut files, while CVE-2024-38226 enabled bypassing Office macro policies through Microsoft Publisher, and CVE-2024-38014 allowed privilege escalation to SYSTEM in Windows Installer. A separate code defect, CVE-2024-43491, had rolled back earlier security fixes for some Windows 10 Optional Components, leaving them in a vulnerable state since March 2024 despite appearing fully patched. (Help Net Security)

Ivanti confirms limited exploitation of Cloud Services Appliance flaw

Ivanti released a security update for an OS command injection vulnerability, CVE-2024-8190, affecting Cloud Services Appliance (CSA) 4.6 on any version before patch 519. Ivanti confirmed limited exploitation of the flaw, which could let a threat actor take control of an affected system, and urged customers to move to CSA 5.0 since version 4.6 had reached end-of-life and no longer received support. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog, requiring federal civilian agencies to remediate it by a set due date. (CISA)

Ivanti patches maximum-severity Endpoint Manager vulnerability

Ivanti fixed a maximum-severity vulnerability, CVE-2024-29847, in its Endpoint Manager solution that could let unauthenticated attackers remotely execute code through improper deserialization of untrusted data in the agent portal, affecting EPM 2024 before the September update and EPM 2022 SU5 and earlier. The release, EPM v2022 SU6 and a hot patch for EPM 2024, also addressed fifteen additional vulnerabilities, including nine critical SQL injection flaws and an XML entity flaw capable of leaking API secrets. Ivanti said the issues were found through its responsible disclosure program. (Help Net Security)

Veeam Backup & Replication RCE flaw patched amid ransomware concerns

Veeam fixed CVE-2024-40711, a critical unspecified vulnerability in Veeam Backup & Replication (VBR) affecting version 12.1.2.172 and earlier, that researchers warned could soon be leveraged by attackers to steal enterprise data. Code White researcher Florian Hauser discovered the flaw, and watchTowr Labs confirmed its potential for exploitation leading to full system takeover; Censys separately identified 2,833 internet-facing VBR servers exposed online. Veeam urged administrators to update to VBR 12.2 (build 12.2.0.334), noting that ransomware groups had previously targeted VBR vulnerabilities to reach backup infrastructure. (Help Net Security)

CISA and FBI warn of false claims of hacked voter data

CISA and the FBI jointly issued a public service announcement warning that false claims of hacked voter registration databases were likely intended to sow distrust in U.S. elections ahead of the 2024 cycle. The agencies said foreign actors and cybercriminals had spread disinformation across multiple election cycles to manipulate public opinion and discredit the electoral process. CISA Senior Advisor Cait Conley said the announcement aimed to educate the public that such claims should not be accepted at face value, since most voter registration information is already publicly available. (CISA)

Report finds cybersecurity budget growth slowing to single digits

Research from IANS Research and Artico Search found that cybersecurity budget growth cooled to single digits, rising from 6% in 2023 to 8% in 2024, well below the 16% and 17% growth recorded in 2021 and 2022. Nearly two-thirds of CISOs reported budget increases, a quarter saw flat budgets, and 12% faced declines. Security budgets grew to 13.2% of IT spending and 0.69% of revenue in 2024. Staff growth also slowed, falling from 31% in 2022 to 12% in 2024, based on responses gathered from 755 CISOs. (Help Net Security)