erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: November 18, 2024

1 editorial brief, 3 known exploited (cisa kev) additions and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: Operation Lunar Peek. Anyone running PAN-OS 10.2-11.2 (or 10.1 for CVE-2024-9474) whose management web interface was reachable from the internet or untrusted networks, including via a management profile on a dataplane or GlobalProtect interface.
  • Do you run any of these? Palo Alto Networks PAN-OS, Progress Kemp LoadMaster. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-12-09.
  • Maven: 1 critical advisory (org.apache.tomcat:tomcat-catalina). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 1 critical advisory (cobbler). Check with pip-audit (or: pip show <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-0012, CVE-2024-9474

PAN-OS Management Auth Bypass Chain (Lunar Peek)

Exploited at scale in late 2024 and patched for almost two years; if your management interface was ever internet-reachable, verify the fix and hunt for leftovers rather than assume you are clean.

Must act: Anyone running PAN-OS 10.2-11.2 (or 10.1 for CVE-2024-9474) whose management web interface was reachable from the internet or untrusted networks, including via a management profile on a dataplane or GlobalProtect interface.

Can relax: Cloud NGFW and Prisma Access customers, and teams whose management interface has always been restricted to a trusted internal jump host and who are on a fixed release.

  1. Confirm every firewall and Panorama runs a fixed release or later (show system info | match sw-version).
  2. Restrict management interface access to trusted internal IPs only; remove management profiles from internet-facing dataplane and GlobalProtect interfaces.
  3. If you have Threat Prevention, keep Threat IDs 95746, 95747, 95752, 95753, 95759 and 95763 in block mode.

Read the brief →

Known exploited (CISA KEV) 3

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2024-9474Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Management Interface OS Command Injection Vulnerability Ransomware		2024-12-09
CVE-2024-1212Progress Kemp LoadMaster
Progress Kemp LoadMaster OS Command Injection Vulnerability		2024-12-09
CVE-2024-0012Palo Alto Networks PAN-OS
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability Ransomware		2024-12-09

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

  • Apache Tomcat - Authentication Bypass CVE-2024-52316 CVSS 9.8 Critical
    org.apache.tomcat:tomcat-catalina < 9.0.96 → fixed in 9.0.96; org.apache.tomcat:tomcat-catalina >= 10.1.0-M1, < 10.1.30 → fixed in 10.1.30; org.apache.tomcat:tomcat-catalina >= 11.0.0-M1, <= 11.0.0-M26 → fixed in 11.0.1

PyPI 1

Check: pip-audit (or: pip show <package>)