Latest Breaking News On - மைக்ரோசாஃப்ட் செய்தி வரிசை - Page 1 : comparemela.com
More patches for SolarWinds Orion after researchers find flaw allowing low-priv users to execute code, among others
theregister.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from theregister.com Daily Mail and Mail on Sunday newspapers.
Three More Vulnerabilities Found in SolarWinds Products
Phil Muncaster UK / EMEA News Reporter , Infosecurity Magazine
Security researchers have discovered three more vulnerabilities in SolarWinds products, including a critical remote code execution bug.
The IT management software provider has been in the news regularly over recent weeks after its Orion product was targeted by alleged Russian state hackers, in a major supply chain attack aimed at the US government.
A vulnerability patched in December was at the center of a new report this week claiming that Chinese state-sponsored threat actors exploited it as part of a cyber-espionage attack on a US federal payroll agency.
Get Permission
Data breaches often turn out to be worse than they first appear, as investigators begin probing exactly what happened and when.
The massive SolarWinds supply chain attack, which was identified by FireEye in December 2020 after it traced back a breach of its systems that resulted in the theft of penetration testing tools, has already fit that mold in spades. Now, it appears that attackers had backdoored SolarWinds Orion network monitoring software by last March, which was used by 18,000 customers.
Incident responders have been racing to identify exactly who then got hit with second-stage attacks via the Orion backdoor, dubbed Sunburst, as well as what types of information they may have stolen. Victims are suspected to number in the hundreds, and are known to include Microsoft and Cisco, as well as the U.S. government s Commerce, Energy, Homeland Security, Justice, Labor, State and Treasury departments.
Robert Scammell 3rd February 2021 (Last Updated February 3rd, 2021 12:57)
Ascannio / Shutterstock.com
Share Article
Security researchers have discovered three “severe” security flaws in IT products made by SolarWinds, the company at the centre of a sprawling cyberattack that compromised up to 18,000 customers.
The most critical SolarWinds vulnerability allows remote code execution with high privileges of the company’s Orion platform, used for IT management.
The other two vulnerabilities are exploitable by someone with local access to take control of the SOLARWINDS ORION database, which could allow an attacker to steal data or add a new user with admin-level privileges. All three vulnerabilities have now been patched.
vimarsana © 2020. All Rights Reserved.