Our latest weekly vulnerability review highlights the most noteworthy flaws affecting a variety of products, including Mozilla Firefox, Google Chrome, NGINX, Cisco appliances, and more.
Mozilla released security updates that fix a slew of vulnerabilities in its Firefox browser and Thunderbird email application, including several high-severity flaws, which allow a remote attacker to compromise a system (CVE-2020-12387 ), bypass sandbox restrictions or escalate privileges on a system (CVE-2020-12388, CVE-2020-12389), or execute arbitrary code on a target system (CVE-2020-6831).
Google has also addressed a couple of dangerous vulnerabilities in its Chrome browser, successful exploitation of which would allow remote code execution.Cisco released a bundle of security updates to address 34 vulnerabilities across Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD), including 12 high-severity flaws. While the majority of the vulnerabilities are denial of service, the path traversal vulnerability (CVE-2020-3187) appears to be the most notable, with a CVSSv3 score of 9.1.
The flaw surfaces in the web services of Cisco’s Adaptive Security Appliance and Firepower Threat Defense software when the WebVPN or AnyConnect feature is configured. A remote, unauthenticated attacker could send a specially crafted HTTP request using “directory traversal character sequences” to the affected device, allowing the attacker to read or delete sensitive files from the web services file system.
NGINX Controller webserver contains two vulnerabilities the most severe of which (CVE-2020-5895 ) allows a remote attacker to execute arbitrary code on the target system. The vulnerability exists due to a boundary error when processing messages in Analytics, Visibility, and Reporting daemon. A remote attacker can pass specially crafted message to the application, trigger memory corruption and execute arbitrary code on the target system.
The flaw affects NGINX Controller versions 3.0.0, 3.1.0, 3.2.0, 3.3.0.
Salt, a configuration management tool provided by SaltStack, is affected by a couple of vulnerabilities (CVE-2020-11651, CVE-2020-11652). Two flaws are a directory traversal issue and an authentication bypass vulnerability respectively. Chaining the issue, an attacker could bypass authentication and run arbitrary code on Salt master servers exposed online.Note: These vulnerabilities have already been exploited in attacks against a number of organizations that rely on the technology, including LineageOS, a free Android-based operating system, and Ghost, a popular blogging platform
SaltStack has made updates available to resolve the issue.
Multiple vulnerabilities have been found in Advantech WebAccess/SCADA solution, the most dangerous of which allow a remote attacker to execute arbitrary code on the target system.
Zoho ManageEngine EventLog Analyzer contains a high risk vulnerability, using which a remote attacker could execute arbitrary code on a target system. The flaw stems from the insufficient validation of user-supplied input in the product pages. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the system.