erroneo.us
Search all guides⌘K

Digest · Tuesday

Security digest: August 29, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: ZeroQlik. Owners of self-managed Qlik Sense Enterprise for Windows servers that were reachable from the internet, especially any not updated past the September 2023 CVE-2023-48365 patches.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-41266, CVE-2023-41265

Qlik Sense ZeroQlik Bugs: Pre-Auth RCE Used by Cactus

Patched since 2023, but the first fix was incomplete and Cactus ransomware hit hundreds of exposed servers; confirm every Qlik Sense server is past the CVE-2023-48365 fix, off the open internet, and free of qle.ttf.

Must act: Owners of self-managed Qlik Sense Enterprise for Windows servers that were reachable from the internet, especially any not updated past the September 2023 CVE-2023-48365 patches.

Can relax: Qlik Cloud customers and QlikView users, which Qlik says are not affected, and internal-only servers kept on current releases.

  1. Inventory every Qlik Sense Enterprise for Windows server and record its release and patch level.
  2. Upgrade to a current supported release; at minimum be past the CVE-2023-48365 fix for your track.
  3. Remove direct internet exposure: use a VPN, secure remote access or an IP allowlist.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.