security vulnerability Archives

Tech Optimizer

February 14, 2025

High-severity SQL vulnerability found in PostgreSQL tool

Rapid7 has identified a SQL injection vulnerability, CVE-2025-1094, affecting all supported PostgreSQL versions prior to 17.3, 16.7, 15.11, 14.16, and 13.19, with a CVSS 3.1 base score of 8.1. This vulnerability is linked to another vulnerability, CVE-2024-12356, which allows unauthenticated remote code execution in BeyondTrust's solutions. Exploiting CVE-2024-12356 requires prior exploitation of CVE-2025-1094. The issue arises from flawed assumptions in PostgreSQL's string escaping routines, particularly in handling invalid UTF-8 characters, which can lead to SQL injection through the psql tool. Attackers can execute arbitrary SQL statements and operating system shell commands under certain conditions. Users are advised to upgrade to secure PostgreSQL versions to mitigate risks. A Metasploit exploit module for CVE-2025-1094 is also available for vulnerable BeyondTrust systems.

Winsage

December 21, 2024

Windows 11 Vulnerability Lets Attackers Execute Code to Gain Access

Microsoft has addressed a significant security vulnerability in Windows 11 (version 23H2), identified as CVE-2024-30085, which allowed local attackers to gain SYSTEM-level privileges. The flaw was discovered by security researcher Alex Birnberg during the TyphoonPWN 2024 competition, where he demonstrated the vulnerability, earning third place. The issue lies in the Cloud Files Mini Filter Driver (cldflt.sys), which fails to properly validate user-supplied data during the parsing of reparse points, allowing attackers to overwrite memory and execute code with elevated privileges. To exploit this vulnerability, an attacker must first run low-privileged code on the system. Microsoft has released a patch for this vulnerability, and users are advised to update their systems to ensure security.

Winsage

December 17, 2024

New Microsoft Windows Security Deadline—CISA Says Update Before Jan. 6

CISA has added the Microsoft Windows kernel security vulnerability CVE-2024-35250 to its Known Exploited Vulnerabilities catalog, requiring organizations to address it by January 6, 2025. This vulnerability, characterized as a "Windows Kernel-Mode Driver Elevation of Privilege Vulnerability," allows attackers to escalate privileges from local user to administrator and was patched in June 2024. The attack complexity is rated as low, making it easier to exploit. CISA advises all organizations to prioritize remediation of this vulnerability, which affects all versions from Windows 10 and Windows Server 2008 onward.

Winsage

December 14, 2024

New Critical Windows Defender Vulnerability Confirmed By Microsoft

Microsoft confirmed a critical security vulnerability in Windows Defender, designated as CVE-2024-49071, which could allow unauthorized access to sensitive information indexed during global file searches. The vulnerability arose from inadequate restrictions on access to the search index for private documents. Despite the potential risk, there have been no known exploitations of this flaw, and an attacker would need some level of access to exploit it. Microsoft has resolved the issue through backend fixes and advises users that no action is necessary on their part.

Winsage

December 11, 2024

New Windows 0Day Attack Confirmed—Homeland Security Says Update Now

Microsoft has confirmed a zero-day security vulnerability, CVE-2024-49138, which poses a significant risk of full system compromise for Windows devices. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included this vulnerability in its Known Exploited Vulnerability Catalog and recommends immediate action to mitigate risks. CVE-2024-49138 is a heap-based buffer overflow in the Microsoft Windows Common Log File System driver, affecting various editions of Windows since Server 2008. It has a CVSSv3.1 score of 7.8 and is rated Important by Microsoft, with risk-based prioritization suggesting it should be treated as Critical. Evidence indicates that this vulnerability is being exploited in the wild, raising concerns about potential ransomware attacks. Users are urged to update their systems promptly.

Winsage

December 11, 2024

Microsoft Fixes Zero-Day, Critical RCEs in Patch Tuesday

A Windows zero-day security vulnerability, tracked as CVE-2024-49138 (CVSS 7.8), exists in the Windows Common Log File System (CLFS) Driver, allowing privilege escalation. This vulnerability can be exploited by manipulating log files or corrupting log data, potentially leading to SYSTEM-level privileges on Windows Server. Microsoft’s December 2024 Patch Tuesday update includes 71 patches, bringing the total for the year to 1,020, with 16 classified as critical. Among these, CVE-2024-49112 (CVSS 9.8) is a critical remote code execution (RCE) vulnerability in Windows LDAP, which can compromise Domain Controllers. CVE-2024-49117 (CVSS 8.8) affects Windows Hyper-V, allowing code execution on the host OS from a guest VM. Additionally, CVE-2024-49132 (CVSS 8.1) impacts Windows Remote Desktop Services, enabling RCE through a use-after-free memory condition. Other vulnerabilities include CVE-2024-49093 (CVSS 8.8), an elevation of privilege flaw in Windows Resilient File System (ReFS), and CVE-2024-49063, an RCE issue in the Musik project related to AI-generated music.

Winsage

December 6, 2024

0patch uncovers a security vulnerability in all versions of Windows — and releases free fixes

0patch has disclosed a 0day vulnerability affecting all desktop versions of Windows, including Windows Server, identified as a URL File NTLM Hash Disclosure vulnerability. This flaw impacts 21 different editions of the operating system, spanning from Windows 7 and Server 2008 R2 to Windows 11 v24H2 and Server 2022. The vulnerability allows an attacker to extract a user's NTLM credentials by having the user open a malicious file in Windows Explorer. 0patch has reported the issue to Microsoft, which has not yet provided a remedy, and has released free micropatches for all affected versions. Users can obtain the micropatch by creating a complimentary account in 0patch Central. The affected Windows editions include both legacy versions and those still receiving updates.

Winsage

December 2, 2024

Windows Server 2012 0-day Vulnerability Let Attackers Bypass Security Checks

A significant security vulnerability has been identified in Windows Server 2012 and Server 2012 R2, allowing attackers to bypass security measures enforced by the Mark of the Web (MotW) feature. This zero-day flaw has existed for over two years and affects certain file types, posing a risk even to fully updated systems and those with Extended Security Updates. The vulnerability was discovered by 0patch security researchers and reported to Microsoft, which has developed free micropatches to mitigate the issue until an official fix is released. The affected systems include Windows Server 2012 and 2012 R2, both updated to October 2023, and those with Extended Security Updates. Free micropatches are available for immediate protection on systems with the 0patch Agent. Security experts recommend applying the micropatches, monitoring for official updates from Microsoft, considering upgrades to supported server versions, and implementing additional security measures.

Tech Optimizer

November 29, 2024

8.8 Rated PostgreSQL Vulnerability Puts Databases at Risk

Cybersecurity researchers Tal Peleg and Coby Abrams from Varonis have identified a significant security vulnerability in PostgreSQL, designated as CVE-2024-10979, which has a CVSS severity score of 8.8. This vulnerability affects all PostgreSQL versions prior to 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21. It allows unprivileged users to manipulate environment variables within the PostgreSQL PL/Perl extension, potentially enabling arbitrary code execution. PostgreSQL's advisory states that this flaw can lead to data theft or system takeover by altering sensitive process environment variables. Users are advised to update to the fixed versions and implement restrictions on allowed extensions and user permissions to mitigate the risk.

Winsage

November 24, 2024

This popular Windows utility for ZIP files has a dangerous vulnerability

A significant security vulnerability has been identified in early versions of the file compression software 7-Zip, with a severity score of 7.8 out of 10. The flaw affects all versions prior to 24.07, allowing potential attackers to execute arbitrary code on a victim's machine. The issue was discovered by Trend Micro’s Zero Day Initiative, with researcher Nicholas Zubrisky identifying it in June. Users are advised to update to the latest version to mitigate risks associated with this vulnerability.