Apple Security Advisory 05-13-2024-2 - iOS 17.5 and iPadOS 17.5 addresses bypass and code execution vulnerabilities.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256APPLE-SA-05-13-2024-2 iOS 17.5 and iPadOS 17.5iOS 17.5 and iPadOS 17.5 addresses the following issues.Information about the security content is also available athttps://support.apple.com/HT214101.Apple maintains a Security Releases page athttps://support.apple.com/HT201222 which lists recentsoftware updates with security advisories.AppleAVDAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An app may be able to execute arbitrary code with kernelprivilegesDescription: The issue was addressed with improved memory handling.CVE-2024-27804: Meysam Firouzi (@R00tkitSMM)AppleMobileFileIntegrityAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker may be able to access user dataDescription: A logic issue was addressed with improved checks.CVE-2024-27816: Mickey Jin (@patch1t)AVEVideoEncoderAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An app may be able to disclose kernel memoryDescription: The issue was addressed with improved memory handling.CVE-2024-27841: an anonymous researcherFind MyAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: A malicious application may be able to determine a user'scurrent locationDescription: A privacy issue was addressed by moving sensitive data to amore secure location.CVE-2024-27839: Alexander Heinrich, SEEMOO, TU Darmstadt (@Sn0wfreeze),and Shai Mishali (@freak4pc)KernelAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker may be able to cause unexpected app termination orarbitrary code executionDescription: The issue was addressed with improved memory handling.CVE-2024-27818: pattern-f (@pattern_F_) of Ant Security Light-Year LabLibsystemAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An app may be able to access protected user dataDescription: A permissions issue was addressed by removing vulnerablecode and adding additional checks.CVE-2023-42893: an anonymous researcherMapsAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An app may be able to read sensitive location informationDescription: A path handling issue was addressed with improvedvalidation.CVE-2024-27810: LFY@secsys of Fudan UniversityMarketplaceKitAvailable for: iPhone XS and laterImpact: A maliciously crafted webpage may be able to distribute a scriptthat tracks users on other webpagesDescription: A privacy issue was addressed with improved client IDhandling for alternative app marketplaces.CVE-2024-27852: Talal Haj Bakry and Tommy Mysk of Mysk Inc. (@mysk_co)NotesAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker with physical access to an iOS device may be able toaccess notes from the lock screenDescription: This issue was addressed through improved state management.CVE-2024-27835: Andr.EssRemoteViewServicesAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker may be able to access user dataDescription: A logic issue was addressed with improved checks.CVE-2024-27816: Mickey Jin (@patch1t)ScreenshotsAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker with physical access may be able to share items fromthe lock screenDescription: A permissions issue was addressed with improved validation.CVE-2024-27803: an anonymous researcherShortcutsAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: A shortcut may output sensitive user data without consentDescription: A path handling issue was addressed with improvedvalidation.CVE-2024-27821: Kirin (@Pwnrin), zbleet, and Csaba Fitzl (@theevilbit)of KandjiSync ServicesAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An app may be able to bypass Privacy preferencesDescription: This issue was addressed with improved checksCVE-2024-27847: Mickey Jin (@patch1t)Voice ControlAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker may be able to elevate privilegesDescription: The issue was addressed with improved checks.CVE-2024-27796: ajajfxhjWebKitAvailable for: iPhone XS and later, iPad Pro 12.9-inch 2nd generationand later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation andlater, iPad Air 3rd generation and later, iPad 6th generation and later,and iPad mini 5th generation and laterImpact: An attacker with arbitrary read and write capability may be ableto bypass Pointer AuthenticationDescription: The issue was addressed with improved checks.WebKit Bugzilla: 272750CVE-2024-27834: Manfred Paul (@_manfp) working with Trend Micro's ZeroDay InitiativeAdditional recognitionApp StoreWe would like to acknowledge an anonymous researcher for theirassistance.CoreHAPWe would like to acknowledge Adrian Cable for their assistance.Face IDWe would like to acknowledge Lucas Monteiro, Daniel Monteiro, and FelipeMonteiro for their assistance.HearingCoreWe would like to acknowledge an anonymous researcher for theirassistance.Managed ConfigurationWe would like to acknowledge 遥遥领先 (@晴天组织) for their assistance.Safari DownloadsWe would like to acknowledge Arsenii Kostromin (0x3c3e) for theirassistance.Status BarWe would like to acknowledge Abhay Kailasia (@abhay_kailasia) of LakshmiNarain College of Technology Bhopal for their assistance.This update is available through iTunes and Software Update on youriOS device, and will not appear in your computer's Software Updateapplication, or in the Apple Downloads site. Make sure you have anInternet connection and have installed the latest version of iTunesfrom https://www.apple.com/itunes/  iTunes and Software Update on thedevice will automatically check Apple's update server on its weeklyschedule. When an update is detected, it is downloaded and the optionto be installed is presented to the user when the iOS device isdocked. We recommend applying the update immediately if possible.Selecting Don't Install will present the option the next time youconnect your iOS device.  The automatic update process may take up toa week depending on the day that iTunes or the device checks forupdates. You may manually obtain the update via the Check for Updatesbutton within iTunes, or the Software Update on your device.  Tocheck that the iPhone, iPod touch, or iPad has been updated:  *Navigate to Settings * Select General * Select About. The versionafter applying this update will be "iOS 17.5 and iPadOS 17.5".All information is also posted on the Apple Security Releasesweb site: https://support.apple.com/HT201222.This message is signed with Apple's Product Security PGP key,and details are available at:https://www.apple.com/support/security/pgp/-----BEGIN PGP SIGNATURE-----iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmZCru4ACgkQX+5d1TXaIvrSLxAAnqj3N4PyUOrHm+zOFx2kEM5qVOwxJVlqbH9Q6DMG2L54N2iTmyR4X0W85uOA9hmHW9TdR+OT85zMXSXdNWn16BMzUtYQjXTk4pU4dEpcD/V5Vjs8dq+LX6YH1Y9/M8K/wh7oAmPfnRQbCitEvwMRpXglHQbfeydUKhri67LeNRYKpYu7KRZrFP+XSfFfqJOI4a1FM/xDgFALCsDVws/qdk1K9o0NoxEjKcwvTplCoNtHajjW1l3QT4nMxgcueMqfJL99nbCzisEmwovbhD17UQDA4zrxrRejCjY233g7uDB6vIkQDCUzSqo82lb+HO0uCMG3rkMQs1jt6iCNYpop4n+tvpLz9DLB+H5PqXXZYQe9dHsEgnuhsMCRlpJ7MGgAxEaIs/bZQLVJKa3UEZXbd4s5OUz3kE8tRx5faFj4zIj+8++W+2vI8q8qZNm2hA/APket6twiTDOxjO4uFdo/TGQUtVI+RSAToKAA3k31wNhKXUTTssUb8at9Sto+BA3p/fJ0fZhGWunJ3kABacSuZcp9lQsCB2mIs6f1fBidCCZD+257uaQfNe9bhPaiRJj8JIkbNII07U7Yat+86RVNqZemascU5zZJxsV2vLsOTreptkJ4Wot8ghnhrozRvGjqYPgmsXV350+6tL651rbbQAJbf8APIohEjUIXFQkg6DI==3eb1-----END PGP SIGNATURE-----

Apple Security Advisory 05-13-2024-2

Apple Security Advisory 05-13-2024-1 - Safari 17.5 addresses a bypass vulnerability.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

APPLE-SA-05-13-2024-1 Safari 17.5

Safari 17.5 addresses the following issues.  
Information about the security content is also available at  
https://support.apple.com/HT214103.

Apple maintains a Security Releases page at  
https://support.apple.com/HT201222 which lists recent  
software updates with security advisories.

WebKit  
Available for: macOS Monterey and macOS Ventura  
Impact: An attacker with arbitrary read and write capability may be able  
to bypass Pointer Authentication  
Description: The issue was addressed with improved checks.  
WebKit Bugzilla: 272750  
CVE-2024-27834: Manfred Paul (@_manfp) working with Trend Micro's Zero  
Day Initiative

Additional recognition

Safari Downloads  
We would like to acknowledge Arsenii Kostromin (0x3c3e) for their  
assistance.

Safari 17.5 may be obtained from the Mac App Store.  
All information is also posted on the Apple Security Releases  
web site: https://support.apple.com/HT201222.

This message is signed with Apple's Product Security PGP key,  
and details are available at:  
https://www.apple.com/support/security/pgp/  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEsz9altA7uTI+rE/qX+5d1TXaIvoFAmZCrkgACgkQX+5d1TXa  
Ivparg//cfUi2Ylya0hfHUzbXtVdoWnbLApJOXFxAQM/DgKBGg+dtJnVyMNN+I1D  
lN8SOuVIxVK+WedX4OKIdKgFlj48ucLdBAIExRqBq6VdSmlL6JK6WVSa3Vrw2ihC  
U7DH0EtREotFgHPiJQMvmxORIUYONAoWHmgqaYNIcKfO6LByp4nN+VcQLjWmlQmn  
jwXigd6pho/+udTEZesFmBNMnTMoRXiR5v+2kBmFj4BOFkZG1oMXqdPtF8MJDVaW  
McjQBqGHs/ijyyAAd96swKZSvnCFEUQcgV888aJFjHFjyhNz1VC+AsaPT8bHnWh7  
UvkWKgyyMdWMXpC0P9Et2Su4OddCQ/8Z7PI2M3rLL8V75Zq//l7q7wqpkEPFv/BM  
LRcEHP5bWSRFWV57mFLsb44WAxEzl1R1ezroW8oh78gHd5s1upms4fhu6aohO6/E  
jyd9OLwshu8jmEkeJXbcnZh1qiKauaLGoYP/kxFNoEKmexoWMxOrP+d599BgaMvw  
tgGwvuENUE7pnRUWLBqc3T8rtDktUjdSEFBn74bzycc+GNzqbbrQTPm7SlG7t7fJ  
jKQU7gbzViA/P32vLkwwrLMk0w0HsCuyJ8YdRd5tBcegIxZ6z2hLsiUtiHCSF5Wu  
lZZ+QLteehEkHYqafuV4vbCqYeySJveKwi6+TFVI73u/XzsYGcc=  
=Ypt5  
-----END PGP SIGNATURE-----

Apple Security Advisory 05-13-2024-1

Red Hat Security Advisory 2024-2846-03 - An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2846.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: kernel-rt security and bug fix update  
Advisory ID:        RHSA-2024:2846-03  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:2846  
Issue date:         2024-05-15  
Revision:           03  
CVE Names:          CVE-2023-52628  
====================================================================

Summary: 

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

* kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

* kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVE-2023-52628)

Bug Fix(es):

* kernel-rt: kernel: untrusted VMM can trigger int80 syscall handling (JIRA:RHEL-30421)

* kernel-rt: kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write (JIRA:RHEL-31093)

* kernel-rt: update RT source tree to the latest RHEL-9.2 ad hoc schedule build (JIRA:RHEL-34746)

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-52628

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://bugzilla.redhat.com/show_bug.cgi?id=2263875  
https://bugzilla.redhat.com/show_bug.cgi?id=2272041

Red Hat Security Advisory 2024-2846-03

Red Hat Security Advisory 2024-2845-03 - An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

The following advisory data is extracted from:

https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2845.json

Red Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.

- Packet Storm Staff

====================================================================  
Red Hat Security Advisory

Synopsis:           Moderate: kernel security and bug fix update  
Advisory ID:        RHSA-2024:2845-03  
Product:            Red Hat Enterprise Linux  
Advisory URL:       https://access.redhat.com/errata/RHSA-2024:2845  
Issue date:         2024-05-15  
Revision:           03  
CVE Names:          CVE-2023-52628  
====================================================================

Summary: 

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description:

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: untrusted VMM can trigger int80 syscall handling (CVE-2024-25744)

* kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVE-2023-52628)

Bug Fix(es):

* kernel: untrusted VMM can trigger int80 syscall handling (JIRA:RHEL-30266)

* kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write (JIRA:RHEL-31090)

Solution:

https://access.redhat.com/articles/11258

CVEs:

CVE-2023-52628

References:

https://access.redhat.com/security/updates/classification/#moderate  
https://bugzilla.redhat.com/show_bug.cgi?id=2263875  
https://bugzilla.redhat.com/show_bug.cgi?id=2272041

Red Hat Security Advisory 2024-2845-03

Red Hat Security Advisory 2024-2843-03 - An update for.NET 7.0 is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2843.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: .NET 7.0 security updateAdvisory ID:        RHSA-2024:2843-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2843Issue date:         2024-05-15Revision:           03CVE Names:          CVE-2024-30045====================================================================Summary: An update for .NET 7.0 is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 7.0.119 and .NET Runtime 7.0.19.Security Fix(es):* dotnet: stack buffer overrun in Double Parse (CVE-2024-30045)* dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-30045References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2279695https://bugzilla.redhat.com/show_bug.cgi?id=2279697

Red Hat Security Advisory 2024-2843-03

Red Hat Security Advisory 2024-2842-03 - An update for.NET 8.0 is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2842.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Important: .NET 8.0 security updateAdvisory ID:        RHSA-2024:2842-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2842Issue date:         2024-05-14Revision:           03CVE Names:          CVE-2024-30045====================================================================Summary: An update for .NET 8.0 is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.Description:.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.105 and .NET Runtime 8.0.5.Security Fix(es):* dotnet: stack buffer overrun in Double Parse (CVE-2024-30045)* dotnet: denial of service in ASP.NET Core due to deadlock in Http2OutputProducer.Stop() (CVE-2024-30046)For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2024-30045References:https://access.redhat.com/security/updates/classification/#importanthttps://bugzilla.redhat.com/show_bug.cgi?id=2279695https://bugzilla.redhat.com/show_bug.cgi?id=2279697

Red Hat Security Advisory 2024-2842-03

Red Hat Security Advisory 2024-2839-03 - An update for expat is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Issues addressed include a denial of service vulnerability.

    The following advisory data is extracted from:https://access.redhat.com/security/data/csaf/v2/advisories/2024/rhsa-2024_2839.jsonRed Hat officially shut down their mailing list notifications October 10, 2023.  Due to this, Packet Storm has recreated the below data as a reference point to raise awareness.  It must be noted that due to an inability to easily track revision updates without crawling Red Hat's archive, these advisories are single notifications and we strongly suggest that you visit the Red Hat provided links to ensure you have the latest information available if the subject matter listed pertains to your environment.- Packet Storm Staff====================================================================Red Hat Security AdvisorySynopsis:           Moderate: expat security updateAdvisory ID:        RHSA-2024:2839-03Product:            Red Hat Enterprise LinuxAdvisory URL:       https://access.redhat.com/errata/RHSA-2024:2839Issue date:         2024-05-14Revision:           03CVE Names:          CVE-2023-52425====================================================================Summary: An update for expat is now available for Red Hat Enterprise Linux 8.6 Extended Update Support.Red Hat Product Security has rated this update as having a security impact ofModerate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.Description:Expat is a C library for parsing XML documents.Security Fix(es):* expat: parsing large tokens can trigger a denial of service (CVE-2023-52425)For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Solution:https://access.redhat.com/articles/11258CVEs:CVE-2023-52425References:https://access.redhat.com/security/updates/classification/#moderatehttps://bugzilla.redhat.com/show_bug.cgi?id=2262877

Red Hat Security Advisory 2024-2839-03

By Deeba Ahmed
Is FIDO2 truly unbreachable?  Recent research exposes a potential vulnerability where attackers could use MITM techniques to bypass FIDO2 security keys. 
This is a post from HackRead.com Read the original post: MITM Attacks Can Still Bypass FIDO2 Security, Researchers Warn

FIDO2 (Fast Identity Online 2) authentication has been hailed for its security, protecting users from phishing, session hijacking, and some forms of MITM (Man-in-the-Middle) attacks. However, identity protection platform Silverfort suggests attackers might be able to bypass FIDO2 phishing-resistant protections under certain conditions using a sophisticated MITM technique.

Typical MITM attacks allow attackers to intercept user communication and steal login credentials but FIDO2 was designed to be immune to these attacks by using physical security keys, USB tokens, or biometrics. But, Silverfort’s security researcher Dor Segal discovered that FIDO2 isn’t immune to these threats.

For your information, developed by the Fast Identity Online (FIDO) Alliance, FIDO2 is based on public key cryptography in which a user registers with an online service and chooses an authentication mechanism like a USB token. The client device generates a public and private key pair. The public key is encrypted and shared with the service, and the private key is securely stored on the user’s device.

The problem occurs because most Web applications fail to protect session tokens after successful authentication, allowing attackers to steal them, impersonate the victim, and gain access to all applications via single sign-on (SSO).

That’s because third-party solutions like SSO create authentication sessions without protecting tokens and traffic sessions, which can linger for hours, unlike Transport Layer Security (TLS) mechanisms that encrypt traffic.

While TLS makes MITM attacks more difficult, attackers can still use methods like Address Resolution Protocol (ARP) poisoning, and Stateless Address Autoconfiguration (SLAAC) to secure MITM positions, waiting for the victim to use SSO to connect to a secure Web application, Segal noted. 

If the subsequent session is not protected, the adversary can steal tokens, perform session hijacking, and impersonate the victim.

The research, published by Silverfort on May 10, 2024, examines three use cases:

*   Entra ID SSO
*   PingFederate.
*   Yubico Playground

Yubico Playground tests FIDO security features, revealing session hijacking risks. Entra ID SSO has security but limits passwordless mechanisms, mainly FIDO2 whereas PingFederate uses third-party adapters, but MITM attacks can occur if developers don’t validate tokens.

According to the research, the weakest link in the SSO chain was SSO protocols, highlighting the need for robust authentication mechanisms. 

****Security****

Organizations using FIDO2 to secure SSO authentication should change the default setting and enable token-binding when possible. Token Binding enables applications and services to securely bind security tokens to the TLS layer, preventing token theft and MITM attacks. This is especially important for developers who may not be security-savvy and are unaware of this option.

****Experts Opinion****

Jason Soroko, Senior Vice President of Products at Sectigo, shared his thoughts on Silverfort’s report, highlighting that the method should be checked for all authentication techniques. 

“The FIDO2 bypass that Silverfort describes is something that needs to be considered for all authentication techniques because even though FIDO2 is based on a strong asymmetric secret, the SSO implementations mostly rely on a much less secure symmetric secret, usually a session token,” explained Jason.

“The attacker, in the worst-case scenario, can take a session token and authenticate as the victim. The main takeaway from this report is that we need to re-examine the idea of token binding and ensure that implementations of FIDO2 are not relying on a weak foundation,” he advised.

1.  Extract encryption keys with Power LED is now possible
2.  kr00k – Billions of Wi-Fi devices affected by encryption flaw
3.  How to Prevent the Encryption Based Malware (Ransomware)
4.  Future of Phishing Email Training for Employees in Cybersecurity
5.  Nespresso Domain Hijacked in Phishing Targeting Microsoft Logins

MITM Attacks Can Still Bypass FIDO2 Security, Researchers Warn

Here’s How to Enhance Your Cyber Resilience with CVSS
In late 2023, the Common Vulnerability Scoring System (CVSS) v4.0 was unveiled, succeeding the eight-year-old CVSS v3.0, with the aim to enhance vulnerability assessment for both industry and the public. This latest version introduces additional metrics like safety and automation to address criticism of lacking granularity

(Cyber) Risk = Probability of Occurrence x Damage 

Microsoft has addressed a total of 61 new security flaws in its software as part of its Patch Tuesday updates for May 2024, including two zero-days which have been actively exploited in the wild.
Of the 61 flaws, one is rated Critical, 59 are rated Important, and one is rated Moderate in severity. This is in addition to 30 vulnerabilities&

Tag

#vulnerability