By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

Adobe today released emergency updates that fix a critical vulnerability for the ColdFusion web app development platform. The bug can lead to arbitrary code execution and has been exploited in the wild. The security issue allows an attacker to bypass restrictions for uploading files. To take advantage of it, the adversary has to be able to upload executable code to a directory of files on a web server. The code can then be executed via an HTTP request, Adobe says in its security bulletin. All ColdFusion versions that do not have the current updates are affected by the vulnerability (CVE-2019-7816), regardless of the platforms, they are for. Charlie Arehart, an independent consultant credited for reporting the vulnerability, told us that he discovered the bug when it was used against one of his clients. If applying the latest updates is not possible at the moment, one method to mitigate the risk is to create restrictions for requests to directories that store uploaded files. Developers should also modify their code to disallow executable extensions and check the list themselves, as is recommended by the Adobe Coldfusion guidelines. They also add the option "Blocked file extensions for CFFile uploads" to the server settings menu to create a list of extensions that should not be uploaded by the cffile tag/functions. More complete details are posted on OUR FORUM.

Facebook currently faces 10 investigations into whether the company — including its WhatsApp and Instagram platforms — violated new European privacy laws, which are stricter than their U.S. counterparts. But it's not the only one. Facebook, Twitter, Apple, and LinkedIn are all being probed by Ireland’s Data Protection Commission, for violating the European Union's General Data Protection Regulation, or GDPR, which was implemented in May 2018, the agency revealed in a report released on Thursday. Ireland's DPC is the lead regulator for the European Union because so many of the multinational tech giants have their European headquarters there. In September, Facebook announced a problem in its "View As" feature that led to an attack on almost 30 million accounts. In December the company announced a software bug that exposed the photos of nearly seven million users to third-party apps without user consent. Three of the potential GDPR violations are related to the September breach, which the company self-reported to the DPC, according to the report. Regulators are examining whether Facebook correctly handled notifying European authorities of the breach and user data. Two probes are focused on WhatsApp, which is often considered the most secure of the platforms because of its end-to-end encryption. One is related to how it handles user privacy and how it shares information with Facebook outside of the app. Twitter and Apple also face two probes each. LinkedIn, which is owned by Microsoft, faces one. While one of the probes against Twitter comes after it self-reported a "large number of breaches," the company is also being investigated for how much access users have to their own data. Is anybody safe from GDPR find out on OUR FORUM?

Users of Kaspersky Antivirus have been complaining since the end of January that when they open Chrome Kaspersky displays numerous alerts stating that there is a problem with a self-signed certificate. It turns out this is being caused by a conflict with a Chromecast device on their network that they may not know even existed. These errors are being displayed by Kaspersky's engine that allows it to scan encrypted SSL traffic for malicious content. In a new Chromium bug report opened today, a Google employee states that there has been an increase in Chromecast discovery issues from Windows users and that it appears to be related to antivirus software. "There's been a sudden increase in device discovery reports," states the bug report. "Reviewing the reports indicated that it's common on the Windows platform. And reviewing of the logs show a commonality of cast channel authentication errors, which can often be attributed to Anti Virus/security software." When investigating further, he noted that Kaspersky users have been complaining about these problems since the end of January, which appears to be the same period that the Chromecast discovery reports started to increase. Google has stated that they have reached out to Kaspersky to resolve the issue. To test this, BleepingComputer fired up a virtual machine and installed a free trial of Kaspersky Total Security. After being installed, I opened Chrome and was immediately greeted with the same error that the Kaspersky users have been seeing. I assure you there's more posted on OUR FORUM.

A new Microsoft laboratory at the Delft University of Technology is the latest step towards making quantum computing a reality. The Microsoft Quantum Lab Delft, which was opened today by King Willem-Alexander of the Netherlands, is the culmination of a partnership between Microsoft and QuTech to collaboratively research the building blocks for a quantum computer. Leo Kouwenhoven, Scientific Director of Microsoft Quantum Lab Delft as well as Professor at the Delft University of Technology, stated that “With the opening of this Lab, we see what is possible when business, science, and the government unite.  Together, we have built a world-class laboratory in Delft which will enable us to expedite the development of a revolutionary quantum computer. The Netherlands now has the necessary ingredients to develop the type of computer power that could drastically change humankind’s daily lives – from personalized medicine to the development of new renewable energy sources.” Unlike current classical computers, quantum computers will be able to perform calculations and tasks at a far faster rate and a greater level of complexity than even the most powerful of today’s supercomputers. Harnessing this computational power has the potential to revolutionize society and the world that we inhabit. The opening of the new lab strengthens the Netherlands’ standing in quantum research, while also offering opportunities to other parties to become involved. During the opening, the Netherlands’ Secretary of State Mona Keijzer (Economic Affairs and Climate) stressed that science, industry, and the government should join forces to consolidate this leading position. Full story posted on OUR FORUM.

The vulnerability was published earlier today by a group of researchers at the University of Cambridge, Department of Computer Science and Technology, Rice University, and SRI International. The paper presentation happened at the Network and Distributed System Security Symposium (NDSS) in San Diego, California. It describes a set of vulnerabilities in macOS, FreeBSD, and Linux, “which notionally utilize IOMMUs to protect against DMA attackers.” The issue is related to the Direct Memory Access enabled by Thunderbolt and is not properly presented by the existing IOMMU protection system. In 2016, OS vendors added Thunderclap mitigation measures to their platforms but the measures are not 100% effective and security flaws still impact systems protected using IOMMU. While some platform such as Windows 7 doesn’t even come with IOMMU, on the OSs where it is present IOMMU is either limited (Windows 10 Enterprise), disabled out of the box. The only platform where it is enabled is macOS, but even then the users aren’t safe given that Thunderclap vulnerabilities can still circumvent it. The best way to protect is to make sure you disable all the thunderbolt ports and don’t share publicly available hardware such as chargers as they might be altered to target devices. The best practice to stay safe is to make sure you don’t leave your laptop unattended. Further details can be found on OUR FORUM.

Researchers have discovered a malspam campaign that is distributing a malicious RAR archive that may be the first one to exploit the newly discovered WinRAR ACE vulnerability to install malware on a computer. Last week, Checkpoint disclosed a 19-year-old vulnerability in the WinRAR UNACEV2.DLL library that allows a specially crafted ACE archive to extract a file to the Window Startup folder when it is extracted. This allows the executable to gain persistence and launch automatically when the user next logs in to Windows. As the developers of WinRAR no longer have access to the source code for the vulnerable UNACEV2.DLL library, instead of fixing the bug, they removed the DLL and ACE support from the latest version of WinRAR 5.70 beta 1.  While this fixes the vulnerability, it also removes all ACE support from WinRAR. Unfortunately, this does not help the approximately 500 million users who allegedly have WinRAR installed on their computers and that is exactly what malware developers are banking on. Today, 360 Threat Intelligence Center tweeted that they have discovered an email that was distributing a RAR archive that when extracted will infect a computer with a backdoor. Once the DLL is loaded, the attackers will be able to access your computer remotely, execute commands, and spread to other computers on your network. As we expect to see more malware attempt to exploit this vulnerability, whether it be through malspam or other methods, it is important that you upgrade to the latest version of WinRAR. There's more posted on OUR FORUM.