Adevonix

adevonix

By

Solaris 10 & 11 PAM Vulnerability October 2020

Pluggable Authentication Module (PAM) Vulnerability

Oracle Solaris 10 & 11 operating systems have a pretty small market share today compared to other operating systems such as Linux and Microsoft Windows. However, over 50% of Solaris deployments are at medium and large organizations in the United States.

In Oracle’s October 2020 patch update, (CVE-2020-14871) is a level 10 (the highest) critical vulnerability in the pluggable authentication module (PAM) of Oracle Solaris. The flaw is locally and remotely exploitable without user credentials, requires no user interaction, and can be implemented as a “low-complexity” attack. Although there are no currently known published exploits, the low-complexity nature of the vulnerability combined with privilege escalation is why CVE-2020-14871 received the CVE level 10 criticality rating.

If you are a business or government agency that relies on Oracle Solaris for your computational workload, be sure you get this patch applied to your systems as soon as possible.

Linked Information

If you use Oracle VM VirtualBox, the same PAM vulnerability applies as well. Download the latest VirtualBox 6.1.16 from Oracle to address the patch.

The entire 2020 list of Oracle vulnerabilities patched in the October patch update. https://www.oracle.com/security-alerts/cpuoct2020.html

The specifics for Solaris 10/11 in regard to CVE-2020-14871 https://www.oracle.com/security-alerts/cpuoct2020.html#AppendixSUNS

By

Microsoft Vulnerability CVE-2020-1472 “Zerologon”

A patch was released by Microsoft in August of 2020 for this level 10 critical security vulnerability reported by Tom Tervoort, Senior Security Researcher at Secura.

When the patch was released in August, there were no reported exploits publicly published. However, on Monday, September 14th, The Cybersecurity and Infrastructure Agency (CISA) reported finding a publicly published exploit of “Zerologon”.

Best practice is to always “patch early and often” but the publishing of the exploit raises the urgency to get systems patched. The service “Netlogon” is the vulnerable service that has the “Zerologon” vulnerability that can be exploited.

If you haven’t patched your Windows servers and especially your domain controllers, we highly suggest you get it scheduled ASAP!

You can read more detail from the Software Engineering Institute’s CERT Coordination Center. Additionally in the CERTCC report, there is content on further mitigation that can be performed that will also be part of a second round of patching from Microsoft in the February 2021 timeframe.

By

Cybersecurity in cloud-based infrastructure – It’s inherent when I choose to use the cloud. Right?

Well, no.

Cybersecurity in cloud infrastructure is a shared responsibility model. What most businesses don’t realize is that the majority of the shared responsibility is on the company, not the cloud services provider.

The cloud services vendor provides a core level of security, high-availability, and physical security of its resources that constitute its cloud infrastructure services offerings. It is up to the business to leverage the solutions they provide and also integrate their tools to provide comparable security capabilities to what is sometimes easier to do with on-premise computing.

Just like the on-premise model, the business is responsible for the deployed cloud computing systems and their updates, patching, and general management to include the associated data that is also in the cloud. Whether your business uses Google, Microsoft, or Amazon or another provider’s cloud services, there are a lot of cloud security and management solutions available.

At Adevonix, we are here to help you make decisions about acquisitions and deployments that are right for your business that takes into account your budget and risk. Contact us!