CYBERSECURITY NEWS V. 19.08 – big Microsoft security updates, web application flaws in Amazon Alexa

hexway cybersecurity blog brings you the latest news about attacks and data breaches, emerging malware, and vendor security updates with comments from our experts

Adobe Updates

Adobe's latest security update affects Acrobat, Reader, and Lightroom. In total, 26 vulnerabilities were fixed, 11 of which are deemed critical and could lead to remote code execution. Remote code execution vulnerabilities are most serious because they allow an attacker to run commands without user permission. Adobe is not aware of any exploits for the vulnerabilities. In any case, Adobe recommends Lightroom users to install Lightroom Classic 9.3; Adobe Reader and Acrobat users should update their software to the latest versions.

Citrix fixes critical flaws in XenMobile Server

Citrix has fixed 5 vulnerabilities in Citrix Endpoint Management (CEM). CEM, often referred to as XenMobile Server, enables companies to manage employee mobile devices and mobile apps by controlling security settings and device updates. Two of the five vulnerabilities (CVE-2020-8208 and CVE-2020-8209) have critical severity and could allow unauthenticated attackers to hijack XenMobile servers. The other three vulnerabilities (CVE-2020-8210, CVE-2020-8211, and CVE-2020-8212) are of medium to low severity and could allow CEM administrators to gain access to unauthorized information. Citrix strongly recommends that the users of the versions 10.9, 10.10, 10.11, and 10.12 apply the patches immediately.

Microsoft patches 120 vulnerabilities

In August, Microsoft released fixes for 120 flaws, 2 of which are zero-day bugs exploited in the wild. One zero-day (CVE-2020-1464) is actively exploited and allows bypassing security features designed to prevent the downloading of improperly signed files. The bug affects all supported versions of Windows. Another zero-day (CVE-2020-1380) is a remote code execution (RCE) bug rated critical. It is found in the Internet Explorer scripting engine. Other critical vulnerabilities that have been fixed affect .NET Framework, Media Foundation, Microsoft Edge, Windows Codec Library, MSHTML Engine, Scripting Engine, Windows Media, and Outlook.

Konica Minolta falls victim of ransomware

Konica Minolta has suffered from new ransomware – RansomEXX. As of July 30, 2020, the Konica Minolta product supply and support site has been down for a week. The company's devices were encrypted with an added extension (.K0N1M1N0).

Amazon Alexa exposes personal data

Web application flaws in Amazon Alexa include cross-site scripting (XSS) and cross-origin resource sharing (CORS) vulnerabilities. An attacker could easily exploit them by sending a crafted Amazon link with code to a victim. That allows attackers to remotely install and activate new third-party Alexa apps. An attacker can obtain the victim’s usernames, phone numbers, home address, and banking data.