Critical Security Patches Issued by Microsoft, Adobe and Other Major Software Firms

Critical Security Patches Issued by Microsoft, Adobe and Other Major Software Firms,

Microsoft’s Patch Tuesday update for the month of March has been made officially available with 71 fixes spanning across its software products such as Windows, Office, Exchange, and Defender, among others.
Of the total 71 patches, three are rated Critical and 68 are rated Important in severity. While none of the vulnerabilities are listed as actively exploited, three of them are publicly known

,

Microsoft’s Patch Tuesday update for the month of March has been made officially available with 71 fixes spanning across its software products such as Windows, Office, Exchange, and Defender, among others.
Of the total 71 patches, three are rated Critical and 68 are rated Important in severity. While none of the vulnerabilities are listed as actively exploited, three of them are publicly known

, ,
https://thehackernews.com/2022/03/critical-security-patches-issued-by.html

New 16 High-Severity UEFI Firmware Flaws Discovered in Millions of HP Devices

New 16 High-Severity UEFI Firmware Flaws Discovered in Millions of HP Devices,

Cybersecurity researchers on Tuesday disclosed 16 new high-severity vulnerabilities in various implementations of Unified Extensible Firmware Interface (UEFI) firmware impacting multiple HP enterprise devices.
The shortcomings, which have CVSS scores ranging from 7.5 to 8.8, have been uncovered in HP’s UEFI firmware. The variety of devices affected includes HP’s laptops, desktops, point-of-sale

,

Cybersecurity researchers on Tuesday disclosed 16 new high-severity vulnerabilities in various implementations of Unified Extensible Firmware Interface (UEFI) firmware impacting multiple HP enterprise devices.
The shortcomings, which have CVSS scores ranging from 7.5 to 8.8, have been uncovered in HP’s UEFI firmware. The variety of devices affected includes HP’s laptops, desktops, point-of-sale

, ,
https://thehackernews.com/2022/03/new-16-high-severity-uefi-firmware.html

Google: Russian Hackers Target Ukrainians, European Allies via Phishing Attacks

Google: Russian Hackers Target Ukrainians, European Allies via Phishing Attacks,

A broad range of threat actors, including Fancy Bear, Ghostwriter, and Mustang Panda, have launched phishing campaigns against Ukraine, Poland, and other European entities amid Russia’s invasion of Ukraine.
Google’s Threat Analysis Group (TAG) said it took down two Blogspot domains that were used by the nation-state group FancyBear (aka APT28) – which is attributed to Russia’s GRU military

,

A broad range of threat actors, including Fancy Bear, Ghostwriter, and Mustang Panda, have launched phishing campaigns against Ukraine, Poland, and other European entities amid Russia’s invasion of Ukraine.
Google’s Threat Analysis Group (TAG) said it took down two Blogspot domains that were used by the nation-state group FancyBear (aka APT28) – which is attributed to Russia’s GRU military

, ,
https://thehackernews.com/2022/03/google-russian-hackers-target.html

Google Buys Cybersecurity Firm Mandiant for $5.4 Billion

Google Buys Cybersecurity Firm Mandiant for $5.4 Billion,

Google is officially buying cybersecurity company Mandiant in an all-cash deal approximately valued at $5.4 billion, the two technology firms announced Tuesday.
Mandiant is expected to be folded into Google Cloud upon the closure of the acquisition, which is slated to happen later this year, adding to the latter’s growing portfolio of security offerings such as BeyondCorp Enterprise, VirusTotal,

,

Google is officially buying cybersecurity company Mandiant in an all-cash deal approximately valued at $5.4 billion, the two technology firms announced Tuesday.
Mandiant is expected to be folded into Google Cloud upon the closure of the acquisition, which is slated to happen later this year, adding to the latter’s growing portfolio of security offerings such as BeyondCorp Enterprise, VirusTotal,

, ,
https://thehackernews.com/2022/03/google-buys-cybersecurity-firm-mandiant.html

Samsung Confirms Data Breach After Hackers Leak Galaxy Source Code

Samsung Confirms Data Breach After Hackers Leak Galaxy Source Code,

Samsung on Monday confirmed a security breach that resulted in the exposure of internal company data, including the source code related to its Galaxy smartphones.
« According to our initial analysis, the breach involves some source code relating to the operation of Galaxy devices, but does not include the personal information of our consumers or employees, » the electronics giant told Bloomberg.

,

Samsung on Monday confirmed a security breach that resulted in the exposure of internal company data, including the source code related to its Galaxy smartphones.
« According to our initial analysis, the breach involves some source code relating to the operation of Galaxy devices, but does not include the personal information of our consumers or employees, » the electronics giant told Bloomberg.

, ,
https://thehackernews.com/2022/03/samsung-confirms-data-breach-after.html

Après Nvidia, Samsung se fait dérober une quantité considérable de données sensibles

Après Nvidia, Samsung se fait dérober une quantité considérable de données sensibles,

Des pirates ont publié 190 Go de codes sources. Parmi eux figureraient des données liées aux dispositifs de sécurité des smartphones Galaxy, comme le logiciel Knox ou la TrustZone.

,

Des pirates ont publié 190 Go de codes sources. Parmi eux figureraient des données liées aux dispositifs de sécurité des smartphones Galaxy, comme le logiciel Knox ou la TrustZone.

, ,
https://www.01net.com/actualites/apres-nvidia-samsung-se-fait-derober-une-quantite-considerable-de-donnees-sensibles-2055392.html

Critical « Access:7 » Supply Chain Vulnerabilities Impact ATMs, Medical and IoT Devices

Critical « Access:7 » Supply Chain Vulnerabilities Impact ATMs, Medical and IoT Devices

,

As many as seven security vulnerabilities have been disclosed in PTC’s Axeda software that could be weaponized to gain unauthorized access to medical and IoT devices.
Collectively called « Access:7, » the weaknesses – three of which are rated Critical in severity – potentially affect more than 150 device models spanning over 100 different manufacturers, posing a significant supply chain risk.

,

As many as seven security vulnerabilities have been disclosed in PTC’s Axeda software that could be weaponized to gain unauthorized access to medical and IoT devices.
Collectively called « Access:7, » the weaknesses – three of which are rated Critical in severity – potentially affect more than 150 device models spanning over 100 different manufacturers, posing a significant supply chain risk.

, ,
https://thehackernews.com/2022/03/critical-access7-supply-chain.html

The Continuing Threat of Unpatched Security Vulnerabilities

The Continuing Threat of Unpatched Security Vulnerabilities,

Unpatched software is a computer code containing known security weaknesses. Unpatched vulnerabilities refer to weaknesses that allow attackers to leverage a known security bug that has not been patched by running malicious code. Software vendors write additions to the codes, known as « patches, » when they come to know about these application vulnerabilities to secure these weaknesses.
Adversaries

,

Unpatched software is a computer code containing known security weaknesses. Unpatched vulnerabilities refer to weaknesses that allow attackers to leverage a known security bug that has not been patched by running malicious code. Software vendors write additions to the codes, known as « patches, » when they come to know about these application vulnerabilities to secure these weaknesses.
Adversaries

, ,
https://thehackernews.com/2022/03/the-continuing-threat-of-unpatched.html

Researchers Warn of Linux Kernel ‘Dirty Pipe’ Arbitrary File Overwrite Vulnerability

Researchers Warn of Linux Kernel ‘Dirty Pipe’ Arbitrary File Overwrite Vulnerability,

Linux distributions are in the process of issuing patches to address a newly disclosed security vulnerability in the kernel that could allow an attacker to overwrite arbitrary data into any read-only files and allow for a complete takeover of affected systems.
Dubbed « Dirty Pipe » (CVE-2022-0847, CVSS score: 7.8) by IONOS software developer Max Kellermann, the flaw « leads to privilege escalation

,

Linux distributions are in the process of issuing patches to address a newly disclosed security vulnerability in the kernel that could allow an attacker to overwrite arbitrary data into any read-only files and allow for a complete takeover of affected systems.
Dubbed « Dirty Pipe » (CVE-2022-0847, CVSS score: 7.8) by IONOS software developer Max Kellermann, the flaw « leads to privilege escalation

, ,
https://thehackernews.com/2022/03/researchers-warn-of-linux-kernel-dirty.html

Microsoft Azure ‘AutoWarp’ Bug Could Have Let Attackers Access Customers’ Accounts

Microsoft Azure ‘AutoWarp’ Bug Could Have Let Attackers Access Customers’ Accounts

,

Details have been disclosed about a now-addressed critical vulnerability in Microsoft’s Azure Automation service that could have permitted unauthorized access to other Azure customer accounts and take over control.
« This attack could mean full control over resources and data belonging to the targeted account, depending on the permissions assigned by the customer, » Orca Security researcher Yanir

,

Details have been disclosed about a now-addressed critical vulnerability in Microsoft’s Azure Automation service that could have permitted unauthorized access to other Azure customer accounts and take over control.
« This attack could mean full control over resources and data belonging to the targeted account, depending on the permissions assigned by the customer, » Orca Security researcher Yanir

, ,
https://thehackernews.com/2022/03/microsoft-azure-autowarp-bug-could-have.html