Cisco fixes several critical bugs: Patch Tuesday - Week 3, March 2019

Cisco

This week Cisco releases security updates for five vulnerabilities found in its products. Flaws were mainly specific to Nexus switches and their software, NX-OS. The following are descriptions of the advisories in brief.

• Cisco Nexus 9000 Series Fabric Switches Application Centric Infrastructure Mode Shell Escape Vulnerability - User inputs were improperly sanitized when working with specific CLI commands in Nexus 9000. Attackers could exploit this issue to execute arbitrary commands and gain root-level privileges.
• Cisco NX-OS Software Unauthorized Filesystem Access Vulnerability - NX-OS had weak filesystem permissions which could allow attackers to modify configuration files and bypass authentication on Nexus devices.
• Cisco NX-OS Software Cisco Fabric Services Denial of Service Vulnerability - Cisco Fabric Services were not correctly validated by NX-OS. This could lead to process crashes and denial of service in Nexus devices.
• Cisco NX-OS Software Image Signature Verification Vulnerability - Image Signature Verification feature was incorrectly performing verifications for digital signatures found in software images. This could allow attackers to load and boot malicious images on the device.
• Cisco NX-OS Software CLI Command Injection Vulnerability (CVE-2019-1613) - NX-OS did not properly validate arguments passed to certain CLI commands. This could lead to RCE attacks on Nexus devices.

In addition, Cisco patched a critical vulnerability lying in its network monitoring tool CSPC. This was due to a default account present in the tool which had a static password. It could allow attackers to gain unauthorized access to CSPC.

Nexus users are advised to update to the latest version of the software.

Microsoft

For this week, Microsoft patched a vulnerability that was existing in its Azure Linux Agent platform. It was reported that the flaw was a result of swap files created on resource disks. An attacker could view data in swap files, which is usually hidden. The update remedies the issue by addressing the method of swap information.

Azure Linux Agent users can find the update here.

Intel

In this month, Intel released security advisories surrounding a number of its software and firmware products. Bugs addressed in these advisories have been resolved with updates. Following is the list of the advisories with their brief description:

• Intel® Accelerated Storage Manager in RSTe Advisory - Improper permissions were found to be existing in the installer for Accelerated Storage Manager in RSTe (v5.5 and below). This could have led to privilege escalation in the component.
• Intel® USB 3.0 Creator Utility Advisory - All versions of USB 3.0 Creator Utility had improper permissions set. This could have allowed attackers to enable privilege escalation through local access.
• Intel® Software Guard Extensions SDK Advisory - Double free errors in Intel SGX SDK for Linux ( before version 2.2) and Windows (before version 2.1) enabled unauthorized users to steal information or conduct denial of service.
• Intel® Matrix Storage Manager Advisory - Improper permissions in Intel(R) Matrix Storage Manager 8.9.0.1023 could have led to privilege escalation attacks.
• Intel Firmware 2018.4 QSR Advisory - A string of vulnerabilities in Platform Sample/Silicon Reference firmware could allow attackers to conduct privilege escalation and denial of service attacks.
• Intel® Graphics Driver for Windows* 2018.4 QSR Advisory - Multiple vulnerabilities in User Mode Driver and Kernel Mode of Intel Graphics Driver for Windows could allow attackers to conduct privilege escalation and denial of service attacks.
• Intel® CSME, Server Platform Services, Trusted Execution Engine and Intel® Active Management Technology 2018.4 QSR Advisory - A string of vulnerabilities present in the aforementioned software allowed privilege escalation and denial of service attacks.

Users are suggested to update to the latest version of the software/firmware.

Ubuntu

Ubuntu patched two security vulnerabilities in this week. These flaws were mainly specific to software libraries in the OS. The advisories are described below:

• USN-3906-2: LibTIFF vulnerabilities - LibTIFF library running in Ubuntu 12.04 ESM could be crashed or execute other programs in the system, by an image handling process. While earlier security advisories addressed multiple vulnerabilities, this specifically focused on resolving the issue in Ubuntu 12.04 ESM.
• USN-3911-1: file vulnerabilities - Many vulnerabilities found in ‘file’ tool could have caused a denial of service or RCE attack. Affected versions are Ubuntu 18.10, 18.04 LTS & 16.04 LTS.

The issues can be resolved by updating to the latest version.

VMWare

Security issues concerning two products in VMWare were addressed this month. The vulnerabilities were found in VMWare Horizon and VMWare Workstation.

• VMSA-2019-0003 - This advisory details an information disclosure flaw in Connection Server of VMWare Horizon. A successful hack on this component could reveal internal domain names or IP address. The update patches the flaw.
• VMSA-2019-0002 - The advisory highlights a functional issue in VMWare Workstation which could lead to privilege escalation instances by an unauthorized user. This issue is fixed with an update for Windows workstation (Linux based workstations were not affected).

WordPress

The new version - WordPress 5.1.1 has over 14 fixes and enhancements. It has resolved security issues pertaining to comments managed in the database which could have led to cross-scripting attacks through a WordPress post. Versions 5.1 and prior are affected by this issue.

Users can either download WordPress 5.1.1. here or update from the Dashboard section of WordPress.