Security Leftovers
-
Microsoft investigating two zero-days affecting Exchange Server [Ed: What Microsoft-bribed media has been distracting from lately]
Microsoft says it is investigating two zero-day vulnerabilities reported to be affecting Microsoft Exchange Server 2013, 2016, and 2019.
A blog post issued by the Microsoft Security Response Centre on Thursday said the first, identified as CVE-2022-41040, was a Server-Side Request Forgery vulnerability
The second, identified as CVE-2022-41082, allowed remote code execution when PowerShell was accessible to the attacker.
British security expert Kevin Beaumont was the first to mention the issue in a series of tweets this morning that iTWire reported, wherein he said that it appeared that a new zero-day had been unearthed.
-
New Microsoft Exchange zero-days actively exploited in attacks
Threat actors are exploiting yet-to-be-disclosed Microsoft Exchange zero-day bugs allowing for remote code execution, according to claims made by security researchers at Vietnamese cybersecurity outfit GTSC, who first spotted and reported the attacks.
-
Security updates for Friday
Security updates have been issued by Debian (libsndfile and libvncserver), Fedora (bash), Red Hat (httpd24-httpd, java-1.7.1-ibm, and java-1.8.0-ibm), and SUSE (krb5-appl, libjpeg-turbo, python310, and slurm_20_02).
-
Security Vulnerabilities in Covert CIA Websites - Schneier on Security
Back in 2018, we learned that covert system of websites that the CIA used for communications was compromised by—at least—China and Iran, and that the blunder caused a bunch of arrests, imprisonments, and executions. We’re now learning that the CIA is still “using an irresponsibly secured system for asset communication.”
-
Albanese says Optus has agreed to pay for replacement passports
Optus has agreed to pay for the replacement of passports of users caught up in the data breach that the telco suffered, Prime Minister Anthony Albanese says.
In a tweet this afternoon, he wrote: "An important update for all Australians on the Optus security breach. After actions taken by myself, @SenatorWong and @ClareONeilMP, Optus has agreed to pay for replacement passports for those affected by the data breach.
"What has happened here is unacceptable. Australian companies should do everything they can to protect your data.
"That’s why we’re also reviewing the Privacy Act - and we’re committed to making privacy law stronger."