Red Sky® Alliance
Wapack Labs has been serving information security professionals for over eight years. We invite businesses and organizations, enterprise to small businesses to learn more about cyber threats and how to avoid them. We provide reports, indicators, references and training about targeted, advanced, and emerging cyber threats in our private portal.
Red Sky® Alliance offers TLP White and Green cyber threat reporting for targeted industry segments, international reports and malware/bot analyses.
Let us better prepare you and your team for new cyber threats.
Comments
A 12-year old linux bug affecting all major Linux distruibutions has surfaced allowing attackers to obtain administrative level privileges. Local account access is required to exploit this vulnerability. The vulnerability poses a high risk to Linux systems and is easy to exploit.
According to the Qualsys report:
"pkexec is installed by default on all major Linux distributions (we
exploited Ubuntu, Debian, Fedora, CentOS, and other distributions are
probably also exploitable)"
As a testament to the ease of exploitability, a publicly available exploit was published less than 3 hours after Qualsys's publication.
Due to the ease of exploitation and the severity of the vulnerability, we recommend mitigating Linux systems immediately.
Recommended mitigation (until a vendor patch is available) is to remove the SUID bit from the /usr/bin/pkexec executable using the following command:
# chmod 0755 /usr/bin/pkexec
Reference:
https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
https://blog.qualys.com/vulnerabilities-threat-research/2022/01/25/...
https://access.redhat.com/security/cve/CVE-2021-4034
https://access.redhat.com/security/vulnerabilities/RHSB-2022-001
https://ubuntu.com/security/CVE-2021-4034
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4034
https://github.com/arthepsy/CVE-2021-4034
https://www.fortiguard.com/outbreak-alert/log4j2-vulnerability
• Use caution with e-mails. Avoid clicking on links in unsolicited or suspicious emails and be wary of email attachments. It is always best to go to the site by searching the known and trusted URL and not using the one provided to you. It is also important to verify the sender by contacting them through a known and trusted contact method.
• Be mindful of scam calls and text messages. It is important to only shop through trusted sources and do not give out personal information over the phone unless it is a trusted source.
• If it sounds too good to be true, it likely is. Whether the cyber actor is redirecting you to a fake fraudulent site that appears to be legitimate or is posting a malvertisement (malicious advertisement) with the goal of spreading malware to your system. It is important to verify all ADs by going directly to the known, trusted site.
• Don’t share your information. Most retailers do not need to know our date of birth or social security number for you to simply purchase a gift or gift card. If a retailer is asking for this information, be wary and consider shopping elsewhere.
• Check your online statements frequently. This will help prevent and catch any criminals in the act of using your credit or debit cards.
-
1
-
2
-
3
-
4
-
5
of 34 Next