The all in one place for non-profit security aid.
The Flea APT prospects diplomatic targets. An update on Cl0p’s exploitation of a MOVEit vulnerability. Condi botnet is targeting unpatched TP-Link Archer AX21 routers. Enter the Muddled Libra threat group. Passwordless authentication study released. Fancy Bear noses into Ukrainian email servers. Read More
The CyberWire
Canada’s ‘most prolific hacker’ jailed for two years
[[{“value”:”A 33-year-old man has been sentenced to two years in prison after admitting his part in a series of ransomware and malware attacks that hit more than one thousand individuals, businesses, and organisations — including three police departments.
Read more in my article on the Hot for Security blog.”}]] Read More
Graham Cluley
US Government Says Relying on Chinese Lithium Batteries Is Too Risky
A new document shows the Department of Homeland Security is concerned that Chinese investment in lithium batteries to power energy grids will make them a threat to US supply chain security. Read More
Windows Common Log File System Zero-day (CVE-2024-49138) Exploited in the Wild
A new high-severity security vulnerability, CVE-2024-49138, has been identified as a zero-day in the Windows Common Log File System (CLFS) Driver.
Microsoft confirmed that this vulnerability is categorized as an Elevation of Privilege issue and has been actively exploited in the wild.
Microsoft rated the vulnerability as “Important” with a Common Vulnerability Scoring System (CVSS) score of 7.8 and fixed it at the Microsoft Patch Tuesday, December 2024 update.
A heap-based buffer overflow vulnerability (CWE-122) has been identified, which poses an elevation of privilege risk with a maximum severity rating of “Important.”
This vulnerability has been assessed using Microsoft’s CVSS v3.1 scoring system, resulting in a base score of 7.8 and a temporal score of 6.8. The attack vector is local, requiring low privileges and presenting low attack complexity.
Exploiting this flaw requires no user interaction. The scope remains unchanged, and the impact is high across all three pillars of security: confidentiality, integrity, and availability.
Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar
If successfully exploited, this vulnerability could allow an attacker to gain SYSTEM-level privileges, granting them full control over the affected system.
This could lead to severe consequences, including unauthorized data access, system compromise, and the potential for further exploitation within an organization’s network.
Given the active threat landscape, this vulnerability poses a significant risk to affected systems, and immediate action is recommended.
The issue stems from a heap-based buffer overflow vulnerability in the Windows Common Log File System (CLFS) Driver.
An attacker with local privileges could exploit this flaw to execute arbitrary code, thereby escalating their privileges to the SYSTEM level without any user interaction.
The vulnerability was reported by CrowdStrike’s Advanced Research Team, whose efforts were acknowledged by Microsoft.
Their contribution highlights the importance of collaboration between the security community and vendors to protect customers against emerging threats.
Microsoft has released an official fix for CVE-2024-49138. Customers are strongly advised to:
This vulnerability affects Windows systems utilizing the Common Log File System Driver. Attackers with low privileges and systems with unpatched software are particularly vulnerable.
Since exploitation requires only limited local access and is of low complexity, threat actors could potentially target a broad range of devices.
As attackers continue to exploit CVE-2024-49138, it is imperative for organizations and individuals to prioritize patching and system updates.
Microsoft has already issued a fix, and prompt action will significantly reduce the risk posed by this critical elevation of privilege vulnerability.
Staying vigilant, maintaining strong security postures, and applying updates are essential to mitigate potential damage from this exploitation.
Investigate Real-World Malicious Links,Malware & Phishing Attacks With ANY.RUN - Try for Free
The post Windows Common Log File System Zero-day (CVE-2024-49138) Exploited in the Wild appeared first on Cyber Security News.